GithubHelp home page GithubHelp logo

Comments (36)

CaptainN avatar CaptainN commented on July 24, 2024 34

In case anyone else comes looking - to make current jsdom work (Feb 2019):

import { JSDOM } from 'jsdom'
import DOMPurify from 'dompurify'
const { window } = new JSDOM('<!DOCTYPE html>')
const domPurify = DOMPurify(window)
console.log(domPurify.sanitize(`
        hell <script>alert("hi");</script>
        <div onclick="alert(123);">
                o
        </div>
        world
        <img id="createElement">
`));

from dompurify.

kkomelin avatar kkomelin commented on July 24, 2024 25

@CaptainN Thanks for your solution.
I've gone further and created an isomorphic wrapper which allows using DOMPurify on both frontend and backend seamlessly https://github.com/kkomelin/isomorphic-dompurify
I would appreciate your feedback on the wrapper.

from dompurify.

etiennejcharles avatar etiennejcharles commented on July 24, 2024 8

Well seems like a port was created 2 months ago
https://github.com/kkomelin/isomorphic-dompurify#readme

from dompurify.

EddyVinck avatar EddyVinck commented on July 24, 2024 5

I just stumbled upon this problem. I found a lightweight alternative for a simple DOMPurify use-case that works in Node: https://github.com/leizongmin/js-xss

import xss from 'xss';

export function sanitizeText(string) {
  // only include whitelisted tags, remove the others
  return xss(string, { whiteList: ['b', 'i', 'strong'], stripIgnoreTag: true });
}

It has to be lightweight because I'm using it with server-side rendered React, which runs in Node first but then runs in the browser.

from dompurify.

kkomelin avatar kkomelin commented on July 24, 2024 3

@EddyVinck There are a few xss-filtering solutions on NPM, you're free to use any of them.

What led me to DOMPurify is this presentation Building Secure React Applications by Philippe De Ryck. Since you're working with React, it may interest you too.

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024 1

It supports iojs. (nodejs will be supported in the near future because iojs and nodejs are merging).

Try this:

npm install cure53/DOMPurify jsdom
var document = require('jsdom').jsdom();
var dompurify = require('dompurify')(document.defaultView);
console.log(dompurify.sanitize(`
        hell <script>alert("hi");</script>
        <div onclick="alert(123);">
                o
        </div>
        world
        <img id="createElement">
`));

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

I'm currently trying to implement the NodeIterator myself.

from dompurify.

cure53 avatar cure53 commented on July 24, 2024

Is there any news on this one?

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Nope, sorry. Didn't have time during the last months to work on the NodeIterator. It's still on my list.

from dompurify.

dashed avatar dashed commented on July 24, 2024

Sighs.

Was wondering why I was getting this error.

/path/to/node_modules/dompurify/purify.js:405
        if(typeof document.implementation.createHTMLDocument === 'undefined') 
                  ^
ReferenceError: document is not defined
...

Please don't host DOMPurify on npm if it's not going to work on node.js env; it's not a package manager for libraries that conveniently support CommonJS.

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

npm is not a package manager exclusively for Node.js modules (Please read about the npm 2.0 release).
Also, DOMpurify works great with Browserify, that's why it's on npm.

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Today, I've sent a PR to the jsdom project to include add document.implementation.createHTMLDocument() to living standard.

You were right @cure53, dealing with DOM implementations is really a mess. ;)

from dompurify.

dashed avatar dashed commented on July 24, 2024

Hmmm. Are you planning on adding jsdom as a dependency?

Would it be possible to use cheerio as an alternative?

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Cheerio is a jQuery-like HTML parser, not a DOM implementation (which we need, e.g. for createHTMLDocument, NodeFilter, NodeIterator, etc.).

from dompurify.

cure53 avatar cure53 commented on July 24, 2024

@fhemberger Nice!

Would that mean that w ecan make DOMPurify happen in combination with jsdom? Or do we need to start creating a feature table of missing APIs and work our way through them?

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

NodeFilter and NodeIterator are still missing in jsdom. NodeFilter is just a bunch of constants, NodeIterator is a tiny bit more complex. ;) Both should pass W3C's implementation tests as well.

Then we should be able to use DOMPurify together with jsdom for Node.js.

from dompurify.

dashed avatar dashed commented on July 24, 2024

I have a feeling this can be done without jsdom. DOMPurify caught my attention because of its performance characteristics; and jsdom may slow things down a lot.

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Well, if you know of a different DOM implementation and you can get DOMPurify working with it, we'd happily accept a pull request. At the moment, jsdom is the only thing that comes to my mind …

from dompurify.

cure53 avatar cure53 commented on July 24, 2024

@dashed I fully agree with @fhemberger, if there was a way to do it w/o jsdom: awesome :)

Using DOMPurify with node.js opens many many new doors.

from dompurify.

Shipow avatar Shipow commented on July 24, 2024

Would be really awesome to have it run in full node.js env. Looking forward to see that happening! Good luck guys!

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

I'm already pushing updates to jsdom, I'll have a bit more time in December so I hope we can close this issue by the end of the year. ;)

from dompurify.

wtfuii avatar wtfuii commented on July 24, 2024

+1 for this feature..

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

jsdom 5.1.0 supports NodeIterator: jsdom/jsdom#1092
There are still other issues though, such as firstElementChild

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Thanks, I read the announcement (but hadn't notice the version has already been released).
I hope to find the time soon to look into this topic again. Sorry this takes so long, but fiddling around with a DOM implementation in Node is really messy. ;)

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

jsdom 5.2.0 has many fixes to make dompurify work. Most html snippets can now be "purified" properly.
Although I have to load dompurify as a script using jsdom.env because dompurify uses a lot of globals. It would be great if I could instantiate dompurify by passing it a Window.

There are still a few test cases failing though, which would require more work in jsdom. One example is that jsdom currently throws an exception if an attribute is set with an invalid name: foo.innerHTML = "<img id/=' >". The spec says that resolving parser errors is optional, but it is of course not how the browsers behave. The result is that dompurify is not able to clean up such snippets.

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

Above has been fixed. There are now 13 failing test cases.
Additional stuff to fix in jsdom:

  • A few test cases with svg tags fail, the output looks safe, but it is not what the test cases expect
  • stub or implement adoptNode
  • stub or implement activeElement
  • Do not throw if the style attribute contains invalid CSS: https://github.com/chad3814/CSSStyleDeclaration/issues/30
  • Implement insertAdjacentHTML (required if you want to use KEEP_CONTENT)

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Thanks @Joris-van-der-Wel for digging into this, looks like we're getting closer.
Unfortunately, I'm pretty occupied at the moment, so I'm not able to dive into the jsdom code right now to implement the missing features. 😞

from dompurify.

cure53 avatar cure53 commented on July 24, 2024

A quick question: I think we are close to the next release. Should we go ahead or wait for you guys? Not sure how far this ticket is in total, thus asking :)

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

No, don't wait for me. Just go ahead and release it. Node support would be a major version increment anyway.

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

As for releasing:
I do not think that any XSS attempts will get through if you use jsdom with these unresolved issues. The effects of these issues are:

  • adoptNode, activeElement and maybe others that are not in the test cases may get clobbered if you only filter using jsdom. These are not causing XSS leaks.
  • Invalid CSS in style tags will throw. For example if DOMPurify is used in a node http server, it would give clients a 500 error instead of the sanitized html.
  • The KEEP_CONTENT option does not work at all

The only thing I am not sure about yet are the 2 cases (87 and 173) that fail with svg content. I have not looked at those extensively. Perhaps all those need are an additional "expected" value in the test case itself.

Here is the output of the test cases: https://joris-van-der-wel.github.io/DOMPurify-04d7218-on-jsdom-5.4.0.html and here is the script I used to generate this https://joris-van-der-wel.github.io/DOMPurify-test-jsdom.js

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

So if none of those issues can cause a security issue, I would say, release it

from dompurify.

dhardtke avatar dhardtke commented on July 24, 2024

So will 0.6.4 support NodeJS?

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

I'm so grateful for your help so we finally got this out. Thanks!

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

I haven't had the time for testing it, but can we close this issue now?

from dompurify.

Joris-van-der-Wel avatar Joris-van-der-Wel commented on July 24, 2024

Well, enabling KEEP_CONTENT has no effect now. Beyond that, I can imagine wanting to add a test runner in DOMPurify for jsdom (also see #61).

And the readme will need updating

from dompurify.

fhemberger avatar fhemberger commented on July 24, 2024

Updated the README just now: 6b0c682.
I'm closing this issue now and create a new issue for KEEP_CONTENT.

from dompurify.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.