fix: sanitize dom first

0x2E · Aug 3, 2024 · 2009a57 · 2009a57
1 parent 0f0d4a1
commit 2009a57
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/frontend/src/routes/items/+page.svelte b/frontend/src/routes/items/+page.svelte
@@ -34,7 +34,9 @@
 			{ tag: 'object', attrs: ['data'] }
 		];
 
-		const dom = new DOMParser().parseFromString(content, 'text/html');
+		const cleaned = DOMPurify.sanitize(content, { FORBID_ATTR: ['class', 'style'] });
+
+		const dom = new DOMParser().parseFromString(cleaned, 'text/html');
 		for (const el of elements) {
 			dom.querySelectorAll(el.tag).forEach((v) => {
 				for (const attr of el.attrs) {
@@ -54,14 +56,12 @@
 			}
 		});
 
-		const replaced = new XMLSerializer().serializeToString(dom);
 		// data.content = data.content.replace(/src="(.*?)"/g, (_, match) => {
 		// 	const res = new URL(match, data.link).href;
 		// 	return `src="${res}"`;
 		// });
 
-		// FIX: sanitize should be the first
-		return DOMPurify.sanitize(replaced, { FORBID_ATTR: ['class', 'style'] });
+		return new XMLSerializer().serializeToString(dom);
 	}
 
 	let fixActionbar = true;