Adding strict and secure rules for html injection and jsom config

plugins/talk-plugin-rich-text/package.json

@@ -7,6 +7,7 @@
   "author": "The Coral Project Team <coral@mozillafoundation.org>",
   "license": "Apache-2.0",
   "dependencies": {
-    "dompurify": "^1.0.3"
+    "dompurify": "^1.0.3",
+    "jsdom": "^11.6.2"
   }
 }

plugins/talk-plugin-rich-text/server/config.js

@@ -1,6 +1,14 @@
 const config = {
   // Super strict rules to make sure users only submit the tags they are allowed
   dompurify: { ALLOWED_TAGS: ['b', 'i', 'blockquote'] },
+
+  // Secure config for jsdom even when DOMPurify creates a document without a browsing context
+  jsdom: {
+    features: {
+      FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+      ProcessExternalResources: false, // do not execute JS within script blocks
+    },
+  },
 };
 
 module.exports = config;

plugins/talk-plugin-rich-text/server/hooks.js

@@ -1,7 +1,12 @@
+const createDOMPurify = require('dompurify');
+const { JSDOM } = require('jsdom');
 const { merge, get } = require('lodash');
-const DOMPurify = require('dompurify');
 const config = require('./config');
 
+// Initializing JSDOM and DOMPurify
+const window = new JSDOM('', config.jsdom).window;
+const DOMPurify = createDOMPurify(window);
+
 module.exports = {
   RootMutation: {
     createComment: {

yarn.lock

@@ -5041,7 +5041,7 @@ jsbn@~0.1.0:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-0.1.1.tgz#a5e654c2e5a2deb5f201d96cefbca80c0ef2f513"
 
-jsdom@^11.3.0:
+jsdom@^11.3.0, jsdom@^11.6.2:
   version "11.6.2"
   resolved "https://registry.yarnpkg.com/jsdom/-/jsdom-11.6.2.tgz#25d1ef332d48adf77fc5221fe2619967923f16bb"
   dependencies: