use dompurify

Signed-off-by: Alex Rybchenko <arybchenko@box.com>

plugins/gcalendar-homepage/package.json

@@ -31,12 +31,12 @@
     "@testing-library/jest-dom": "^5.16.2",
     "classnames": "^2.3.1",
     "cross-fetch": "^3.1.5",
+    "dompurify": "^2.3.6",
     "lodash": "^4.17.21",
     "luxon": "^2.3.0",
     "material-ui-popup-state": "^2.0.0",
     "react-query": "^3.34.16",
-    "react-use": "^17.2.4",
-    "sanitize-html": "^2.7.0"
+    "react-use": "^17.2.4"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17.0.0"
@@ -49,6 +49,7 @@
     "@testing-library/jest-dom": "^5.10.1",
     "@testing-library/react": "^11.2.5",
     "@testing-library/user-event": "^13.1.8",
+    "@types/dompurify": "^2.3.3",
     "@types/gapi": "^0.0.41",
     "@types/gapi.auth2": "^0.0.56",
     "@types/gapi.client.calendar": "^3.0.10",

plugins/gcalendar-homepage/src/components/CalendarCard/CalendarEventPopoverContent.tsx

@@ -15,7 +15,7 @@
  */
 import { sortBy } from 'lodash';
 import React from 'react';
-import sanitizeHtml from 'sanitize-html';
+import DOMPurify from 'dompurify';
 
 import { useAnalytics } from '@backstage/core-plugin-api';
 
@@ -101,7 +101,9 @@ export const CalendarEventPopoverContent = ({
           <Box
             className={classes.description}
             dangerouslySetInnerHTML={{
-              __html: sanitizeHtml(event.description),
+              __html: DOMPurify.sanitize(event.description, {
+                USE_PROFILES: { html: true },
+              }),
             }}
           />
         </>

yarn.lock

@@ -5824,7 +5824,7 @@
     "@types/docker-modem" "*"
     "@types/node" "*"
 
-"@types/dompurify@^2.1.0", "@types/dompurify@^2.2.2":
+"@types/dompurify@^2.1.0", "@types/dompurify@^2.2.2", "@types/dompurify@^2.3.3":
   version "2.3.3"
   resolved "https://registry.npmjs.org/@types/dompurify/-/dompurify-2.3.3.tgz#c24c92f698f77ed9cc9d9fa7888f90cf2bfaa23f"
   integrity sha512-nnVQSgRVuZ/843oAfhA25eRSNzUFcBPk/LOiw5gm8mD9/X7CNcbRkQu/OsjCewO8+VIYfPxUnXvPEVGenw14+w==
@@ -11191,7 +11191,7 @@ dompurify@=2.3.3:
   resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.3.3.tgz#c1af3eb88be47324432964d8abc75cf4b98d634c"
   integrity sha512-dqnqRkPMAjOZE0FogZ+ceJNM2dZ3V/yNOuFB7+39qpO93hHhfRpHw3heYQC7DPK9FqbQTfBKUJhiSfz4MvXYwg==
 
-dompurify@^2.2.7, dompurify@^2.2.9:
+dompurify@^2.2.7, dompurify@^2.2.9, dompurify@^2.3.6:
   version "2.3.6"
   resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.3.6.tgz#2e019d7d7617aacac07cbbe3d88ae3ad354cf875"
   integrity sha512-OFP2u/3T1R5CEgWCEONuJ1a5+MFKnOYpkywpUSxv/dj1LeBT1erK+JwM7zK0ROy2BRhqVCf0LRw/kHqKuMkVGg==
@@ -19696,11 +19696,6 @@ parse-path@^4.0.0:
     is-ssh "^1.3.0"
     protocols "^1.4.0"
 
-parse-srcset@^1.0.2:
-  version "1.0.2"
-  resolved "https://registry.npmjs.org/parse-srcset/-/parse-srcset-1.0.2.tgz#f2bd221f6cc970a938d88556abc589caaaa2bde1"
-  integrity sha1-8r0iH2zJcKk42IVWq8WJyqqiveE=
-
 parse-url@^5.0.0:
   version "5.0.1"
   resolved "https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz#99c4084fc11be14141efa41b3d117a96fcb9527f"
@@ -20513,7 +20508,7 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^
   resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz#723c09920836ba6d3e5af019f92bc0971c02e514"
   integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==
 
-postcss@^8.1.0, postcss@^8.3.11, postcss@^8.4.5:
+postcss@^8.1.0, postcss@^8.4.5:
   version "8.4.6"
   resolved "https://registry.npmjs.org/postcss/-/postcss-8.4.6.tgz#c5ff3c3c457a23864f32cb45ac9b741498a09ae1"
   integrity sha512-OovjwIzs9Te46vlEx7+uXB0PLijpwjXGKXjVGGPIGubGpq7uh5Xgf6D6FiJ/SzJMBosHDp6a2hiXOS97iBXcaA==