From 16218839bac916bdbd34ee2a9fa1858e31803b76 Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Tue, 20 Jul 2021 15:26:03 +0200 Subject: [PATCH 1/7] MVP DOMPurify Swap over sanitize-html Signed-off-by: Eric Peterson --- plugins/techdocs/package.json | 2 ++ .../src/reader/transformers/sanitizeDOM/index.ts | 15 ++++++--------- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/plugins/techdocs/package.json b/plugins/techdocs/package.json index 653fc99146..b0a9e3d350 100644 --- a/plugins/techdocs/package.json +++ b/plugins/techdocs/package.json @@ -44,6 +44,7 @@ "@material-ui/icons": "^4.9.1", "@material-ui/lab": "4.0.0-alpha.45", "@material-ui/styles": "^4.10.0", + "dompurify": "^2.2.9", "eventsource": "^1.1.0", "react": "^16.13.1", "react-dom": "^16.13.1", @@ -63,6 +64,7 @@ "@testing-library/react": "^11.2.5", "@testing-library/react-hooks": "^3.4.2", "@testing-library/user-event": "^13.1.8", + "@types/dompurify": "^2.2.2", "@types/eventsource": "^1.1.5", "@types/jest": "^26.0.7", "@types/node": "^14.14.32", diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts index 65db98ae01..f2ae7df590 100644 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts +++ b/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts @@ -17,20 +17,17 @@ // @ts-ignore import sanitizeHtml from 'sanitize-html'; import type { Transformer } from '../transformer'; -import { TECHDOCS_ALLOWED_TAGS } from './tags'; -import { TECHDOCS_ALLOWED_ATTRIBUTES } from './attributes'; +import DOMPurify from 'dompurify'; // TODO(freben): move all of this out of index export const sanitizeDOM = (): Transformer => { return dom => { - const sanitizedHtml = sanitizeHtml(dom.innerHTML, { - allowedTags: TECHDOCS_ALLOWED_TAGS, - allowedAttributes: TECHDOCS_ALLOWED_ATTRIBUTES, - allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'data', 'blob'], + return DOMPurify.sanitize(dom.innerHTML, { + // TODO: hmm... https://security.stackexchange.com/questions/205975/is-xss-in-canonical-link-possible + ADD_TAGS: ['link'], + WHOLE_DOCUMENT: true, + RETURN_DOM: true, }); - - return new DOMParser().parseFromString(sanitizedHtml, 'text/html') - .documentElement; }; }; From d80be05359ffe64a897eee27d0dc7f96bc8e7b47 Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Wed, 21 Jul 2021 15:38:45 +0200 Subject: [PATCH 2/7] Move sanitize transformer out of its special dir Signed-off-by: Eric Peterson --- .../{sanitizeDOM/index.test.ts => sanitizeDOM.test.ts} | 6 +++--- .../transformers/{sanitizeDOM/index.ts => sanitizeDOM.ts} | 7 +------ 2 files changed, 4 insertions(+), 9 deletions(-) rename plugins/techdocs/src/reader/transformers/{sanitizeDOM/index.test.ts => sanitizeDOM.test.ts} (95%) rename plugins/techdocs/src/reader/transformers/{sanitizeDOM/index.ts => sanitizeDOM.ts} (76%) diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.test.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM.test.ts similarity index 95% rename from plugins/techdocs/src/reader/transformers/sanitizeDOM/index.test.ts rename to plugins/techdocs/src/reader/transformers/sanitizeDOM.test.ts index 6296793e2a..8e5b245941 100644 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.test.ts +++ b/plugins/techdocs/src/reader/transformers/sanitizeDOM.test.ts @@ -14,9 +14,9 @@ * limitations under the License. */ -import { createTestShadowDom, FIXTURES } from '../../../test-utils'; -import { Transformer } from '../index'; -import { sanitizeDOM } from './index'; +import { createTestShadowDom, FIXTURES } from '../../test-utils'; +import { Transformer } from './index'; +import { sanitizeDOM } from './sanitizeDOM'; const injectMaliciousLink = (): Transformer => dom => { const link = document.createElement('a'); diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts similarity index 76% rename from plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts rename to plugins/techdocs/src/reader/transformers/sanitizeDOM.ts index f2ae7df590..5e352e23a1 100644 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM/index.ts +++ b/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts @@ -14,17 +14,12 @@ * limitations under the License. */ -// @ts-ignore -import sanitizeHtml from 'sanitize-html'; -import type { Transformer } from '../transformer'; import DOMPurify from 'dompurify'; - -// TODO(freben): move all of this out of index +import type { Transformer } from './transformer'; export const sanitizeDOM = (): Transformer => { return dom => { return DOMPurify.sanitize(dom.innerHTML, { - // TODO: hmm... https://security.stackexchange.com/questions/205975/is-xss-in-canonical-link-possible ADD_TAGS: ['link'], WHOLE_DOCUMENT: true, RETURN_DOM: true, From 106ac9aa35a2b98b29a219fc4e71559c50e7fb5a Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Tue, 20 Jul 2021 15:45:47 +0200 Subject: [PATCH 3/7] Clean up unneeded tag/attr allow lists. Signed-off-by: Eric Peterson --- .../transformers/sanitizeDOM/attributes.ts | 386 ------------------ .../reader/transformers/sanitizeDOM/tags.ts | 248 ----------- 2 files changed, 634 deletions(-) delete mode 100644 plugins/techdocs/src/reader/transformers/sanitizeDOM/attributes.ts delete mode 100644 plugins/techdocs/src/reader/transformers/sanitizeDOM/tags.ts diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM/attributes.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM/attributes.ts deleted file mode 100644 index 39fb528da9..0000000000 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM/attributes.ts +++ /dev/null @@ -1,386 +0,0 @@ -/* - * Copyright 2020 The Backstage Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -/** - * This is the source of truth of what attributes we support in TechDocs. - */ - -export const html = [ - 'accept', - 'action', - 'align', - 'alt', - 'autocapitalize', - 'autocomplete', - 'autopictureinpicture', - 'autoplay', - 'background', - 'bgcolor', - 'border', - 'capture', - 'cellpadding', - 'cellspacing', - 'checked', - 'cite', - 'class', - 'clear', - 'color', - 'cols', - 'colspan', - 'controls', - 'controlslist', - 'coords', - 'crossorigin', - 'datetime', - 'decoding', - 'default', - 'dir', - 'disabled', - 'disablepictureinpicture', - 'disableremoteplayback', - 'download', - 'draggable', - 'enctype', - 'enterkeyhint', - 'face', - 'for', - 'headers', - 'height', - 'hidden', - 'high', - 'href', - 'hreflang', - 'id', - 'inputmode', - 'integrity', - 'ismap', - 'kind', - 'label', - 'lang', - 'list', - 'loading', - 'loop', - 'low', - 'max', - 'maxlength', - 'media', - 'method', - 'min', - 'minlength', - 'multiple', - 'muted', - 'name', - 'noshade', - 'novalidate', - 'nowrap', - 'open', - 'optimum', - 'pattern', - 'placeholder', - 'playsinline', - 'poster', - 'preload', - 'pubdate', - 'radiogroup', - 'readonly', - 'rel', - 'required', - 'rev', - 'reversed', - 'role', - 'rows', - 'rowspan', - 'spellcheck', - 'scope', - 'selected', - 'shape', - 'size', - 'sizes', - 'span', - 'srclang', - 'start', - 'src', - 'srcset', - 'step', - 'style', - 'summary', - 'tabindex', - 'title', - 'translate', - 'type', - 'usemap', - 'valign', - 'value', - 'width', - 'xmlns', -]; - -export const svg = [ - 'accent-height', - 'accumulate', - 'additive', - 'alignment-baseline', - 'ascent', - 'attributename', - 'attributetype', - 'azimuth', - 'basefrequency', - 'baseline-shift', - 'begin', - 'bias', - 'by', - 'class', - 'clip', - 'clip-path', - 'clip-rule', - 'color', - 'color-interpolation', - 'color-interpolation-filters', - 'color-profile', - 'color-rendering', - 'cx', - 'cy', - 'd', - 'dx', - 'dy', - 'data', - 'diffuseconstant', - 'direction', - 'display', - 'divisor', - 'dur', - 'edgemode', - 'elevation', - 'end', - 'fill', - 'fill-opacity', - 'fill-rule', - 'filter', - 'filterunits', - 'flood-color', - 'flood-opacity', - 'font-family', - 'font-size', - 'font-size-adjust', - 'font-stretch', - 'font-style', - 'font-variant', - 'font-weight', - 'fx', - 'fy', - 'g1', - 'g2', - 'glyph-name', - 'glyphref', - 'gradientunits', - 'gradienttransform', - 'height', - 'href', - 'id', - 'image-rendering', - 'in', - 'in2', - 'k', - 'k1', - 'k2', - 'k3', - 'k4', - 'kerning', - 'keypoints', - 'keysplines', - 'keytimes', - 'lang', - 'lengthadjust', - 'letter-spacing', - 'kernelmatrix', - 'kernelunitlength', - 'lighting-color', - 'local', - 'marker-end', - 'marker-mid', - 'marker-start', - 'markerheight', - 'markerunits', - 'markerwidth', - 'maskcontentunits', - 'maskunits', - 'max', - 'mask', - 'media', - 'method', - 'mode', - 'min', - 'name', - 'numoctaves', - 'offset', - 'operator', - 'opacity', - 'order', - 'orient', - 'orientation', - 'origin', - 'overflow', - 'paint-order', - 'path', - 'pathlength', - 'patterncontentunits', - 'patterntransform', - 'patternunits', - 'points', - 'preservealpha', - 'preserveaspectratio', - 'primitiveunits', - 'r', - 'rx', - 'ry', - 'radius', - 'refx', - 'refy', - 'repeatcount', - 'repeatdur', - 'restart', - 'result', - 'rotate', - 'scale', - 'seed', - 'shape-rendering', - 'specularconstant', - 'specularexponent', - 'spreadmethod', - 'startoffset', - 'stddeviation', - 'stitchtiles', - 'stop-color', - 'stop-opacity', - 'stroke-dasharray', - 'stroke-dashoffset', - 'stroke-linecap', - 'stroke-linejoin', - 'stroke-miterlimit', - 'stroke-opacity', - 'stroke', - 'stroke-width', - 'style', - 'surfacescale', - 'tabindex', - 'targetx', - 'targety', - 'transform', - 'text-anchor', - 'text-decoration', - 'text-rendering', - 'textlength', - 'type', - 'u1', - 'u2', - 'unicode', - 'values', - 'viewbox', - 'visibility', - 'version', - 'vert-adv-y', - 'vert-origin-x', - 'vert-origin-y', - 'width', - 'word-spacing', - 'wrap', - 'writing-mode', - 'xchannelselector', - 'ychannelselector', - 'x', - 'x1', - 'x2', - 'xmlns', - 'y', - 'y1', - 'y2', - 'z', - 'zoomandpan', -]; - -export const mathMl = [ - 'accent', - 'accentunder', - 'align', - 'bevelled', - 'close', - 'columnsalign', - 'columnlines', - 'columnspan', - 'denomalign', - 'depth', - 'dir', - 'display', - 'displaystyle', - 'encoding', - 'fence', - 'frame', - 'height', - 'href', - 'id', - 'largeop', - 'length', - 'linethickness', - 'lspace', - 'lquote', - 'mathbackground', - 'mathcolor', - 'mathsize', - 'mathvariant', - 'maxsize', - 'minsize', - 'movablelimits', - 'notation', - 'numalign', - 'open', - 'rowalign', - 'rowlines', - 'rowspacing', - 'rowspan', - 'rspace', - 'rquote', - 'scriptlevel', - 'scriptminsize', - 'scriptsizemultiplier', - 'selection', - 'separator', - 'separators', - 'stretchy', - 'subscriptshift', - 'supscriptshift', - 'symmetric', - 'voffset', - 'width', - 'xmlns', -]; - -export const xml = [ - 'xlink:href', - 'xml:id', - 'xlink:title', - 'xml:space', - 'xmlns:xlink', -]; - -/** - * Anything in here will be supported as HTML attributes from TechDocs. - * - * @note Be conscious about what you add here. It can affect the TechDocs experience. For - * some review before making a PR, reach out in the #docs-like-code channel in Discord first. - */ -export const TECHDOCS_ALLOWED_ATTRIBUTES = { - '*': [...html, ...svg, ...mathMl, ...xml, 'data-*'], -}; diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM/tags.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM/tags.ts deleted file mode 100644 index 780a4c01f7..0000000000 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM/tags.ts +++ /dev/null @@ -1,248 +0,0 @@ -/* - * Copyright 2020 The Backstage Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -/** - * This is the source of truth for what HTML tags we support in TechDocs. - */ - -// prettier-ignore -export const html = [ - 'a', 'abbr', 'acronym', - 'address', 'area', 'article', - 'aside', 'audio', 'b', 'bdi', - 'bdo', 'big', - 'blink', 'blockquote', - 'body', - 'br', 'button', - 'canvas', 'caption', 'center', 'cite', 'code', - 'col', 'colgroup', - 'content', - 'data', - 'datalist', - 'dd', - 'decorator', - 'del', - 'details', - 'dfn', - 'dir', - 'div', - 'dl', - 'dt', - 'element', - 'em', - 'fieldset', - 'figcaption', - 'figure', - 'font', - 'footer', - 'form', - 'h1', - 'h2', - 'h3', - 'h4', - 'h5', - 'h6', - 'head', - 'header', - 'hgroup', - 'hr', - 'html', - 'i', - 'img', - 'input', - 'ins', - 'kbd', - 'label', - 'legend', - 'li', - 'link', - 'main', - 'map', - 'mark', - 'marquee', - 'menu', - 'menuitem', - 'meter', - 'nav', - 'nobr', - 'ol', - 'optgroup', - 'option', - 'output', - 'p', - 'picture', - 'pre', - 'progress', - 'q', - 'rp', - 'rt', - 'ruby', - 's', - 'samp', - 'section', - 'select', - 'shadow', - 'small', - 'source', - 'spacer', - 'span', - 'strike', - 'strong', - 'sub', - 'summary', - 'sup', - 'table', - 'tbody', - 'td', - 'template', - 'textarea', - 'tfoot', - 'th', - 'thead', - 'time', - 'tr', - 'track', - 'tt', - 'u', - 'ul', - 'var', - 'video', - 'wbr', -]; - -// SVG -export const svg = [ - 'svg', - 'a', - 'altglyph', - 'altglyphdef', - 'altglyphitem', - 'animatecolor', - 'animatemotion', - 'animatetransform', - 'audio', - 'canvas', - 'circle', - 'clippath', - 'defs', - 'desc', - 'ellipse', - 'filter', - 'font', - 'g', - 'glyph', - 'glyphref', - 'hkern', - 'image', - 'line', - 'lineargradient', - 'marker', - 'mask', - 'metadata', - 'mpath', - 'path', - 'pattern', - 'polygon', - 'polyline', - 'radialgradient', - 'rect', - 'stop', - 'switch', - 'symbol', - 'text', - 'textpath', - 'title', - 'tref', - 'tspan', - 'video', - 'view', - 'vkern', -]; - -export const svgFilters = [ - 'feBlend', - 'feColorMatrix', - 'feComponentTransfer', - 'feComposite', - 'feConvolveMatrix', - 'feDiffuseLighting', - 'feDisplacementMap', - 'feDistantLight', - 'feFlood', - 'feFuncA', - 'feFuncB', - 'feFuncG', - 'feFuncR', - 'feGaussianBlur', - 'feMerge', - 'feMergeNode', - 'feMorphology', - 'feOffset', - 'fePointLight', - 'feSpecularLighting', - 'feSpotLight', - 'feTile', - 'feTurbulence', -]; - -export const mathMl = [ - 'math', - 'menclose', - 'merror', - 'mfenced', - 'mfrac', - 'mglyph', - 'mi', - 'mlabeledtr', - 'mmultiscripts', - 'mn', - 'mo', - 'mover', - 'mpadded', - 'mphantom', - 'mroot', - 'mrow', - 'ms', - 'mspace', - 'msqrt', - 'mstyle', - 'msub', - 'msup', - 'msubsup', - 'mtable', - 'mtd', - 'mtext', - 'mtr', - 'munder', - 'munderover', -]; - -export const text = ['#text']; - -/** - * Anything in here will be executed as HTML tags from TechDocs. - * - * @note Be conscious about what you add here. It can affect the TechDocs experience. For - * some review before making a PR, reach out in the #docs-like-code channel in Discord first. - */ -export const TECHDOCS_ALLOWED_TAGS = [ - ...html, - ...svg, - ...svgFilters, - ...mathMl, - ...text, - 'iframe', -]; From 3789b660409e242468dff7d6fd582e7be2a87183 Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Wed, 21 Jul 2021 15:40:07 +0200 Subject: [PATCH 4/7] Remove sanitize-html library in favor of DOMPurify Signed-off-by: Eric Peterson --- plugins/techdocs/package.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/plugins/techdocs/package.json b/plugins/techdocs/package.json index b0a9e3d350..cd4ba7d5bc 100644 --- a/plugins/techdocs/package.json +++ b/plugins/techdocs/package.json @@ -52,8 +52,7 @@ "react-router": "6.0.0-beta.0", "react-router-dom": "6.0.0-beta.0", "react-use": "^17.2.4", - "react-text-truncate": "^0.16.0", - "sanitize-html": "^2.3.2" + "react-text-truncate": "^0.16.0" }, "devDependencies": { "@backstage/cli": "^0.7.4", From 5cc70c10c977dbdc5ce6e1e0f5dd703d64c018f4 Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Tue, 20 Jul 2021 15:47:05 +0200 Subject: [PATCH 5/7] Lock dependencies. Signed-off-by: Eric Peterson --- yarn.lock | 54 +++++++++++++++++++----------------------------------- 1 file changed, 19 insertions(+), 35 deletions(-) diff --git a/yarn.lock b/yarn.lock index 9431895914..17892d19b5 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5619,6 +5619,13 @@ dependencies: "@types/node" "*" +"@types/dompurify@^2.2.2": + version "2.2.3" + resolved "https://registry.npmjs.org/@types/dompurify/-/dompurify-2.2.3.tgz#6e89677a07902ac1b6821c345f34bd85da239b08" + integrity sha512-CLtc2mZK8+axmrz1JqtpklO/Kvn38arGc8o1l3UVopZaXXuer9ONdZwJ/9f226GrhRLtUmLr9WrvZsRSNpS8og== + dependencies: + "@types/trusted-types" "*" + "@types/eslint@*": version "6.1.8" resolved "https://registry.npmjs.org/@types/eslint/-/eslint-6.1.8.tgz#7e868f89bc1e520323d405940e49cb912ede5bba" @@ -6577,6 +6584,11 @@ resolved "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.0.tgz#fef1904e4668b6e5ecee60c52cc6a078ffa6697d" integrity sha512-I99sngh224D0M7XgW1s120zxCt3VYQ3IQsuw3P3jbq5GG4yc79+ZjyKznyOGIQrflfylLgcfekeZW/vk0yng6A== +"@types/trusted-types@*": + version "2.0.2" + resolved "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.2.tgz#fc25ad9943bcac11cceb8168db4f275e0e72e756" + integrity sha512-F5DIZ36YVLE+PN+Zwws4kJogq47hNgX3Nx6WyDJ3kcplxyke3XIzB8uK5n/Lpm1HBsbGzd6nmGehL8cPekP+Tg== + "@types/tunnel@^0.0.1": version "0.0.1" resolved "https://registry.npmjs.org/@types/tunnel/-/tunnel-0.0.1.tgz#0d72774768b73df26f25df9184273a42da72b19c" @@ -11446,6 +11458,11 @@ dompurify@^2.0.12, dompurify@^2.1.1, dompurify@^2.2.8: resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.2.8.tgz#ce88e395f6d00b6dc53f80d6b2a6fdf5446873c6" integrity sha512-9H0UL59EkDLgY3dUFjLV6IEUaHm5qp3mxSqWw7Yyx4Zhk2Jn2cmLe+CNPP3xy13zl8Bqg+0NehQzkdMoVhGRww== +dompurify@^2.2.9: + version "2.3.0" + resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.3.0.tgz#07bb39515e491588e5756b1d3e8375b5964814e2" + integrity sha512-VV5C6Kr53YVHGOBKO/F86OYX6/iLTw2yVSI721gKetxpHCK/V5TaLEf9ODjRgl1KLSWRMY6cUhAbv/c+IUnwQw== + domutils@1.5.1: version "1.5.1" resolved "https://registry.npmjs.org/domutils/-/domutils-1.5.1.tgz#dcd8488a26f563d61079e48c9f7b7e32373682cf" @@ -11462,7 +11479,7 @@ domutils@^1.5.1, domutils@^1.7.0: dom-serializer "0" domelementtype "1" -domutils@^2.0.0, domutils@^2.4.4: +domutils@^2.0.0: version "2.4.4" resolved "https://registry.npmjs.org/domutils/-/domutils-2.4.4.tgz#282739c4b150d022d34699797369aad8d19bbbd3" integrity sha512-jBC0vOsECI4OMdD0GC9mGn7NXPLb+Qt6KW1YDQzeQYRUFKmNG8lh7mO5HiELfr+lLQE7loDVI4QcAxV80HS+RA== @@ -14461,16 +14478,6 @@ htmlparser2@^4.0: domutils "^2.0.0" entities "^2.0.0" -htmlparser2@^6.0.0: - version "6.0.0" - resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-6.0.0.tgz#c2da005030390908ca4c91e5629e418e0665ac01" - integrity sha512-numTQtDZMoh78zJpaNdJ9MXb2cv5G3jwUoe3dMQODubZvLoGvTE/Ofp6sHvH8OGKcN/8A47pGLi/k58xHP/Tfw== - dependencies: - domelementtype "^2.0.1" - domhandler "^4.0.0" - domutils "^2.4.4" - entities "^2.0.0" - http-cache-semantics@^4.0.0, http-cache-semantics@^4.1.0: version "4.1.0" resolved "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz#49e91c5cbf36c9b94bcfcd71c23d5249ec74e390" @@ -16887,11 +16894,6 @@ kleur@^3.0.3: resolved "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz#a79c9ecc86ee1ce3fa6206d1216c501f147fc07e" integrity sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w== -klona@^2.0.3: - version "2.0.4" - resolved "https://registry.npmjs.org/klona/-/klona-2.0.4.tgz#7bb1e3affb0cb8624547ef7e8f6708ea2e39dfc0" - integrity sha512-ZRbnvdg/NxqzC7L9Uyqzf4psi1OM4Cuc+sJAkQPjO6XkQIJTNbfK2Rsmbw8fx1p2mkZdp2FZYo2+LwXYY/uwIA== - knex@^0.95.1: version "0.95.6" resolved "https://registry.npmjs.org/knex/-/knex-0.95.6.tgz#5fc60ffc2935567bf122925526b1b06b8dbca785" @@ -19788,11 +19790,6 @@ parse-path@^4.0.0: is-ssh "^1.3.0" protocols "^1.4.0" -parse-srcset@^1.0.2: - version "1.0.2" - resolved "https://registry.npmjs.org/parse-srcset/-/parse-srcset-1.0.2.tgz#f2bd221f6cc970a938d88556abc589caaaa2bde1" - integrity sha1-8r0iH2zJcKk42IVWq8WJyqqiveE= - parse-url@^5.0.0: version "5.0.1" resolved "https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz#99c4084fc11be14141efa41b3d117a96fcb9527f" @@ -20737,7 +20734,7 @@ postcss-value-parser@^4.0.0, postcss-value-parser@^4.0.2, postcss-value-parser@^ source-map "^0.6.1" supports-color "^6.1.0" -postcss@^8.0.2, postcss@^8.1.0, postcss@^8.2.15: +postcss@^8.1.0, postcss@^8.2.15: version "8.3.5" resolved "https://registry.npmjs.org/postcss/-/postcss-8.3.5.tgz#982216b113412bc20a86289e91eb994952a5b709" integrity sha512-NxTuJocUhYGsMiMFHDUkmjSKT3EdH4/WbGF6GCi1NDGk+vbcUTun4fpbOqaPtD8IIsztA2ilZm2DhYCuyN58gA== @@ -22809,19 +22806,6 @@ sane@^4.0.3: minimist "^1.1.1" walker "~1.0.5" -sanitize-html@^2.3.2: - version "2.4.0" - resolved "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.4.0.tgz#8da7524332eb210d968971621b068b53f17ab5a3" - integrity sha512-Y1OgkUiTPMqwZNRLPERSEi39iOebn2XJLbeiGOBhaJD/yLqtLGu6GE5w7evx177LeGgSE+4p4e107LMiydOf6A== - dependencies: - deepmerge "^4.2.2" - escape-string-regexp "^4.0.0" - htmlparser2 "^6.0.0" - is-plain-object "^5.0.0" - klona "^2.0.3" - parse-srcset "^1.0.2" - postcss "^8.0.2" - sax@1.2.1: version "1.2.1" resolved "https://registry.npmjs.org/sax/-/sax-1.2.1.tgz#7b8e656190b228e81a66aea748480d828cd2d37a" From 2b1ac002d99cccb1fa529f10eb8e3f7283233bed Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Tue, 20 Jul 2021 15:52:46 +0200 Subject: [PATCH 6/7] Changeset Signed-off-by: Eric Peterson --- .changeset/techdocs-she-was-gone.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/techdocs-she-was-gone.md diff --git a/.changeset/techdocs-she-was-gone.md b/.changeset/techdocs-she-was-gone.md new file mode 100644 index 0000000000..a6821abcf6 --- /dev/null +++ b/.changeset/techdocs-she-was-gone.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-techdocs': patch +--- + +TechDocs now uses a "safe by default" sanitization library, rather than relying on its own, hard-coded list of allowable tags and attributes. From 59e2987eb0982eb4291004ea1b6e694a30f4f7dd Mon Sep 17 00:00:00 2001 From: Eric Peterson Date: Wed, 21 Jul 2021 16:32:14 +0200 Subject: [PATCH 7/7] Forbid style tags, per existing test. Signed-off-by: Eric Peterson --- plugins/techdocs/src/reader/transformers/sanitizeDOM.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts b/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts index 5e352e23a1..84dea567a2 100644 --- a/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts +++ b/plugins/techdocs/src/reader/transformers/sanitizeDOM.ts @@ -21,6 +21,7 @@ export const sanitizeDOM = (): Transformer => { return dom => { return DOMPurify.sanitize(dom.innerHTML, { ADD_TAGS: ['link'], + FORBID_TAGS: ['style'], WHOLE_DOCUMENT: true, RETURN_DOM: true, });