[FIX] Add sanitizer to prevent XSS attacks

package.json

@@ -90,6 +90,7 @@
 		"css-vars-ponyfill": "^2.3.2",
 		"date-fns": "^2.15.0",
 		"desvg": "^1.0.2",
+		"dompurify": "^2.2.6",
 		"emoji-mart": "^3.0.0",
 		"history": "^5.0.0",
 		"i18nline": "^2.0.1",

src/components/Composer/index.js

@@ -1,3 +1,4 @@
+import { sanitize } from 'dompurify';
 import mem from 'mem';
 import { h, Component } from 'preact';
 
@@ -62,7 +63,7 @@ export class Composer extends Component {
 	}
 
 	handleInput = (onChange) => () => {
-		onChange && onChange(this.el.innerText);
+		onChange && onChange(sanitize(this.el.innerText));
 	}
 
 	handleKeypress = (onSubmit) => (event) => {

src/components/Messages/MessageText/markdown.js

@@ -1,3 +1,4 @@
+import { sanitize } from 'dompurify';
 import MarkdownIt from 'markdown-it';
 
 
@@ -80,4 +81,4 @@ md.use((md) => {
 	});
 });
 
-export const renderMarkdown = (...args) => md.render(...args);
+export const renderMarkdown = (...args) => sanitize(md.render(...args));

yarn.lock

@@ -5684,6 +5684,11 @@ domhandler@^2.3.0:
   dependencies:
     domelementtype "1"
 
+dompurify@^2.2.6:
+  version "2.2.6"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-2.2.6.tgz#54945dc5c0b45ce5ae228705777e8e59d7b2edc4"
+  integrity sha512-7b7ZArhhH0SP6W2R9cqK6RjaU82FZ2UPM7RO8qN1b1wyvC/NY1FNWcX1Pu00fFOAnzEORtwXe4bPaClg6pUybQ==
+
 domutils@1.5.1:
   version "1.5.1"
   resolved "https://registry.yarnpkg.com/domutils/-/domutils-1.5.1.tgz#dcd8488a26f563d61079e48c9f7b7e32373682cf"