TechDocs: Enable allowVulnerableTags in sanitize-html (#2554)

* enable allowVulnerableTags in sanitize-html * Fixed lint issue * Removed style tag from allowed list. Seems to work fine. * Added tests to make sure we keep link tags and remove style tags
2020-09-22 14:22:52 +02:00
parent 01b511a2a8
commit 999ff914af
2 changed files with 38 additions and 2 deletions
@@ -62,4 +62,42 @@ describe('sanitizeDOM', () => {
      shadowDom.querySelector('#test-malicious-link')?.hasAttribute('onclick'),
    ).toBeFalsy();
  });
+
+  it('removes style tags', () => {
+    const html = `
+      <html>
+        <head>
+          <style>* {color: #f0f;}<style>
+        </head>
+        <body>
+        </body>
+      </html>
+    `;
+
+    const shadowDom = createTestShadowDom(html, {
+      preTransformers: [sanitizeDOM()],
+      postTransformers: [],
+    });
+
+    expect(shadowDom.querySelectorAll('style').length).toEqual(0);
+  });
+
+  it('does not remove link tags', () => {
+    const html = `
+      <html>
+        <head>
+          <link rel="stylesheet" href="style.css">
+        </head>
+        <body>
+        </body>
+      </html>
+    `;
+
+    const shadowDom = createTestShadowDom(html, {
+      preTransformers: [sanitizeDOM()],
+      postTransformers: [],
+    });
+
+    expect(shadowDom.querySelectorAll('link').length).toEqual(1);
+  });
 });
@@ -101,7 +101,6 @@ export const html = [
  'span',
  'strike',
  'strong',
-  'style',
  'sub',
  'summary',
  'sup',
@@ -162,7 +161,6 @@ export const svg = [
  'radialgradient',
  'rect',
  'stop',
-  'style',
  'switch',
  'symbol',
  'text',