Adding strict and secure rules for html injection and jsom config

plugins/talk-plugin-rich-text/package.json

@@ -7,6 +7,7 @@
   "author": "The Coral Project Team <coral@mozillafoundation.org>",
   "license": "Apache-2.0",
   "dependencies": {
-    "dompurify": "^1.0.3"
+    "dompurify": "^1.0.3",
+    "jsdom": "^11.6.2"
   }
 }

plugins/talk-plugin-rich-text/server/config.js

@@ -1,6 +1,14 @@
 const config = {
   // Super strict rules to make sure users only submit the tags they are allowed
   dompurify: { ALLOWED_TAGS: ['b', 'i', 'blockquote'] },
+
+  // Secure config for jsdom even when DOMPurify creates a document without a browsing context
+  jsdom: {
+    features: {
+      FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+      ProcessExternalResources: false, // do not execute JS within script blocks
+    },
+  },
 };
 
 module.exports = config;

plugins/talk-plugin-rich-text/server/hooks.js

@@ -1,7 +1,12 @@
+const createDOMPurify = require('dompurify');
+const { JSDOM } = require('jsdom');
 const { merge, get } = require('lodash');
-const DOMPurify = require('dompurify');
 const config = require('./config');
 
+// Initializing JSDOM and DOMPurify
+const window = new JSDOM('', config.jsdom).window;
+const DOMPurify = createDOMPurify(window);
+
 module.exports = {
   RootMutation: {
     createComment: {