MVP DOMPurify Swap over sanitize-html

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

plugins/techdocs/package.json

@@ -44,6 +44,7 @@
     "@material-ui/icons": "^4.9.1",
     "@material-ui/lab": "4.0.0-alpha.45",
     "@material-ui/styles": "^4.10.0",
+    "dompurify": "^2.2.9",
     "eventsource": "^1.1.0",
     "react": "^16.13.1",
     "react-dom": "^16.13.1",
@@ -63,6 +64,7 @@
     "@testing-library/react": "^11.2.5",
     "@testing-library/react-hooks": "^3.4.2",
     "@testing-library/user-event": "^13.1.8",
+    "@types/dompurify": "^2.2.2",
     "@types/eventsource": "^1.1.5",
     "@types/jest": "^26.0.7",
     "@types/node": "^14.14.32",

plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts

@@ -17,20 +17,17 @@
 // @ts-ignore
 import sanitizeHtml from 'sanitize-html';
 import type { Transformer } from '../transformer';
-import { TECHDOCS_ALLOWED_TAGS } from './tags';
-import { TECHDOCS_ALLOWED_ATTRIBUTES } from './attributes';
+import DOMPurify from 'dompurify';
 
 // TODO(freben): move all of this out of index
 
 export const sanitizeDOM = (): Transformer => {
   return dom => {
-    const sanitizedHtml = sanitizeHtml(dom.innerHTML, {
-      allowedTags: TECHDOCS_ALLOWED_TAGS,
-      allowedAttributes: TECHDOCS_ALLOWED_ATTRIBUTES,
-      allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'data', 'blob'],
+    return DOMPurify.sanitize(dom.innerHTML, {
+      // TODO: hmm...  https://security.stackexchange.com/questions/205975/is-xss-in-canonical-link-possible
+      ADD_TAGS: ['link'],
+      WHOLE_DOCUMENT: true,
+      RETURN_DOM: true,
     });
-
-    return new DOMParser().parseFromString(sanitizedHtml, 'text/html')
-      .documentElement;
   };
 };