MVP DOMPurify Swap over sanitize-html

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts

@@ -17,20 +17,17 @@
 // @ts-ignore
 import sanitizeHtml from 'sanitize-html';
 import type { Transformer } from '../transformer';
-import { TECHDOCS_ALLOWED_TAGS } from './tags';
-import { TECHDOCS_ALLOWED_ATTRIBUTES } from './attributes';
+import DOMPurify from 'dompurify';
 
 // TODO(freben): move all of this out of index
 
 export const sanitizeDOM = (): Transformer => {
   return dom => {
-    const sanitizedHtml = sanitizeHtml(dom.innerHTML, {
-      allowedTags: TECHDOCS_ALLOWED_TAGS,
-      allowedAttributes: TECHDOCS_ALLOWED_ATTRIBUTES,
-      allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'data', 'blob'],
+    return DOMPurify.sanitize(dom.innerHTML, {
+      // TODO: hmm...  https://security.stackexchange.com/questions/205975/is-xss-in-canonical-link-possible
+      ADD_TAGS: ['link'],
+      WHOLE_DOCUMENT: true,
+      RETURN_DOM: true,
     });
-
-    return new DOMParser().parseFromString(sanitizedHtml, 'text/html')
-      .documentElement;
   };
 };