diff --git a/plugins/talk-plugin-rich-text/package.json b/plugins/talk-plugin-rich-text/package.json index e665c2799..7ef08ec80 100644 --- a/plugins/talk-plugin-rich-text/package.json +++ b/plugins/talk-plugin-rich-text/package.json @@ -7,6 +7,7 @@ "author": "The Coral Project Team ", "license": "Apache-2.0", "dependencies": { - "dompurify": "^1.0.3" + "dompurify": "^1.0.3", + "jsdom": "^11.6.2" } } diff --git a/plugins/talk-plugin-rich-text/server/config.js b/plugins/talk-plugin-rich-text/server/config.js index d01749189..eec559ce0 100644 --- a/plugins/talk-plugin-rich-text/server/config.js +++ b/plugins/talk-plugin-rich-text/server/config.js @@ -1,6 +1,14 @@ const config = { // Super strict rules to make sure users only submit the tags they are allowed dompurify: { ALLOWED_TAGS: ['b', 'i', 'blockquote'] }, + + // Secure config for jsdom even when DOMPurify creates a document without a browsing context + jsdom: { + features: { + FetchExternalResources: false, // disables resource loading over HTTP / filesystem + ProcessExternalResources: false, // do not execute JS within script blocks + }, + }, }; module.exports = config; diff --git a/plugins/talk-plugin-rich-text/server/hooks.js b/plugins/talk-plugin-rich-text/server/hooks.js index fe6d53548..81b41b9f0 100644 --- a/plugins/talk-plugin-rich-text/server/hooks.js +++ b/plugins/talk-plugin-rich-text/server/hooks.js @@ -1,7 +1,12 @@ +const createDOMPurify = require('dompurify'); +const { JSDOM } = require('jsdom'); const { merge, get } = require('lodash'); -const DOMPurify = require('dompurify'); const config = require('./config'); +// Initializing JSDOM and DOMPurify +const window = new JSDOM('', config.jsdom).window; +const DOMPurify = createDOMPurify(window); + module.exports = { RootMutation: { createComment: { diff --git a/yarn.lock b/yarn.lock index 657268ca3..d24c5fa58 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5041,7 +5041,7 @@ jsbn@~0.1.0: version "0.1.1" resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-0.1.1.tgz#a5e654c2e5a2deb5f201d96cefbca80c0ef2f513" -jsdom@^11.3.0: +jsdom@^11.3.0, jsdom@^11.6.2: version "11.6.2" resolved "https://registry.yarnpkg.com/jsdom/-/jsdom-11.6.2.tgz#25d1ef332d48adf77fc5221fe2619967923f16bb" dependencies: