[FIX] Server-side marked parsing (#20665)

RocketChat · Feb 10, 2021 · a875da3 · a875da3
1 parent a06735f
commit a875da3
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/app/markdown/lib/parser/marked/marked.js b/app/markdown/lib/parser/marked/marked.js
@@ -1,3 +1,4 @@
+import { Meteor } from 'meteor/meteor';
 import { Random } from 'meteor/random';
 import _ from 'underscore';
 import _marked from 'marked';
@@ -106,7 +107,15 @@ export const marked = (message, {
 		highlight,
 	});
 
-	message.html = dompurify.sanitize(message.html, { ADD_ATTR: ['target'] });
+	if (Meteor.isServer) {
+		const { JSDOM } = require('jsdom');
+		const createDOMPurify = require('dompurify');
+		const { window } = new JSDOM('');
+		const serverDomPurify = createDOMPurify(window);
+		message.html = serverDomPurify.sanitize(message.html, { ADD_ATTR: ['target'] });
+	} else {
+		message.html = dompurify.sanitize(message.html, { ADD_ATTR: ['target'] });
+	}
 
 	return message;
 };