fix: Use Dompurify to strip style characters (#2632)

2021-07-15 12:54:31 +05:30
parent d7982a6ffd
commit aa7db90cd2
5 changed files with 34 additions and 27 deletions
--- a/app/javascript/shared/mixins/messageFormatterMixin.js
+++ b/app/javascript/shared/mixins/messageFormatterMixin.js
@@ -1,4 +1,5 @@
 import MessageFormatter from '../helpers/MessageFormatter';
+import DOMPurify from 'dompurify';

 export default {
  methods: {
@@ -17,5 +18,24 @@ export default {

      return `${description.slice(0, 97)}...`;
    },
+    stripStyleCharacters(message) {
+      return DOMPurify.sanitize(message, {
+        FORBID_TAGS: ['style'],
+        FORBID_ATTR: [
+          'id',
+          'class',
+          'style',
+          'bgcolor',
+          'valign',
+          'width',
+          'face',
+          'color',
+          'height',
+          'lang',
+          'align',
+          'size',
+        ],
+      });
+    },
  },
 };