Comments (10)
Ok, will fork project and give a try on local build. Thanks! Will let you know after
from dompurify.
Hmm, not sure if I understand the use case fully. What is the problem with using uponSanitizeElement
and how would overriding Array.push
which we use to populate the DOMPurify.removed
array make things different?
from dompurify.
My idea to have something like
const { html, removed } = DOMPurify.sanitize(html, {
FORCE_BODY: true,
ADD_TAGS: ['script']
});
to check and return removed and sanitized elements in one component scope. Right now i'm trying to use Map where i collect elements by specific component id but this solution far from ideal 😅.
And i rely on uponSanitizeElement
right now but this hook can fire in other subscribed components as well. Also i know that i shouldn't rely on removed 😅 but i need to display notification to user if user really wants to run scripts.
I can prepare sandbox if it will help
from dompurify.
I see, can you not make the hook check for the component scope and treat elements conditionally?
from dompurify.
Codesandbox here example.
2 issues:
- In react env
uponSanitizeElement
hook will not fire in any of effects on first render (this is solvable) - In component scope we cannot say in which component sanitize really happened and in which component instance hook called
from dompurify.
Ah, I see. And if we had a hook registered inside _forceRemove
your problem would be solved? Like, somewhere here?
const _forceRemove = function (node) {
arrayPush(DOMPurify.removed, { element: node });
try {
// eslint-disable-next-line unicorn/prefer-dom-node-remove
node.parentNode.removeChild(node);
} catch (_) {
node.remove();
}
};
from dompurify.
Yep, i think so. at least we can give a try 😅
from dompurify.
I am not against adding this, if you can confirm that it works and where exactly the hook should be placed in this method, I can add it. Or a PR from you 🙂
from dompurify.
Due to some policies i cannot work on this by myself. Discovered yesterday 😅. And we will need some key for this hook as well otherwise removeNode
hook will be called for each subscription as well. So it will be
const result = DOMPurify.sanitize(hmtl, {key: `some-unique-key`})
and then in hook
DOMPurify.addHook(`removeNode`,(node, data) => {
if(data.key === 'some-unique-key') {
....do some logic here
}
})
but not sure if you will like this change 😅
. Also i found another solution to just show notification globally and for now it will be fine 😅. So we can close this issue
from dompurify.
Oh, haha - okay :) Will do that now, let me know if we can do anything.
from dompurify.
Related Issues (20)
- Exception when passing 0 or "" or null to Dompurify.Sanitize Method #947 HOT 3
- Latest versions of DOMPurify 2.5.x block custom SVG elements when they are set via ADD_TAGS config. HOT 6
- release 3.1.3 assets are the same as 3.1.2 HOT 1
- Number.isNaN is not supported in MSIE HOT 15
- Bower issues : DOMPurify is not defined HOT 5
- HTML and BODY tags are being regardless of `ALLOWED_TAGS` settings HOT 2
- MAX_NESTING_DEPTH remove contents issue HOT 5
- Escape unsafe characters instead of removing them HOT 3
- The MAX_NESTING_DEPTH remove contents issue has not been resolved. HOT 3
- A code comment containing a tag name structure leads to removal of the entire block HOT 2
- Issue secure [email protected] Apache-2.0 + Fair + MPL-2.0 HOT 1
- KEEP_CONTENT remove contents of all ALLOWED_TAGS HOT 2
- <img> xss vulnerability
- MathML Content Markup Removed HOT 2
- Policy creator HOT 2
- name='lang' Attribute Removed During Sanitization HOT 1
- DOM Purify Allows onfocus events HOT 1
- Incorrect remove of `feFunc*` attr
- [bug] DomPurify hangs on indefinitely when using SAFE_FOR_TEMPLATES=true HOT 3
- DOMPurify.sanitize() leaves executable code HOT 13
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dompurify.