Skip to content

DLSV2-637 Sanitise html strings submitted to database using Jodit edi… #1373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Aug 26, 2022
Merged

DLSV2-637 Sanitise html strings submitted to database using Jodit edi… #1373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
059869e
DLSV2-637 Sanitise html strings submitted to database using Jodit edi…
manishagarwalEviden Aug 25, 2022
47a2896
Merge branch 'master' into DLSV2-614
kevwhitt-hee Aug 26, 2022
f5603fe
Merge branch 'master' into DLSV2-614
kevwhitt-hee Aug 26, 2022
716a5e0
Merge branch 'DLSV2-614' of https://github.com/TechnologyEnhancedLear…
kevwhitt-hee Aug 26, 2022
33e3709
Update yarn.lock
kevwhitt-hee Aug 26, 2022
1975c28
Update htmleditor.ts
kevwhitt-hee Aug 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion DigitalLearningSolutions.Web/Controllers/FrameworksController/AssessmentQuestions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
using DigitalLearningSolutions.Data.Models.SessionData.Frameworks;
using System.Collections.Generic;
using DigitalLearningSolutions.Data.Enums;
using DigitalLearningSolutions.Web.Helpers;

public partial class FrameworksController
{
Expand Down Expand Up @@ -430,7 +431,8 @@ public IActionResult EditAssessmentQuestionOptions(AssessmentQuestionDetail asse
if (!ModelState.IsValid)
{
return RedirectToAction("EditAssessmentQuestionOptions", "Frameworks", new { frameworkId, assessmentQuestionId, frameworkCompetencyId });
}
}
assessmentQuestionDetail.ScoringInstructions = SanitizerHelper.SanitizeHtmlData(assessmentQuestionDetail.ScoringInstructions);
SessionAssessmentQuestion sessionAssessmentQuestion = multiPageFormService.GetMultiPageFormData<SessionAssessmentQuestion>(
MultiPageFormDataFeature.EditAssessmentQuestion,
TempData
Expand Down
344 changes: 174 additions & 170 deletions DigitalLearningSolutions.Web/Controllers/FrameworksController/Competencies.cs
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions DigitalLearningSolutions.Web/Controllers/FrameworksController/Frameworks.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ namespace DigitalLearningSolutions.Web.Controllers.FrameworksController
using DigitalLearningSolutions.Data.Helpers;
using DigitalLearningSolutions.Data.Models.SearchSortFilterPaginate;
using DigitalLearningSolutions.Web.Attributes;
using DigitalLearningSolutions.Web.Helpers;
using DigitalLearningSolutions.Web.Models.Enums;
using DigitalLearningSolutions.Web.ViewModels.Common;
using System.Net;
Expand Down Expand Up @@ -335,6 +336,7 @@ public IActionResult FrameworkDescription(DetailFramework detailFramework, strin
}
return RedirectToAction("FrameworkType", "Frameworks", new { actionname });
}
detailFramework.Description = SanitizerHelper.SanitizeHtmlData(detailFramework.Description);
frameworkService.UpdateFrameworkDescription(frameworkId, GetAdminId(), detailFramework.Description);
return RedirectToAction("ViewFramework", new { tabname = "Details", frameworkId });

Expand Down Expand Up @@ -739,6 +741,7 @@ public IActionResult InsertFramework()
logger.LogWarning($"Failed to create framework: adminId: {adminId}");
return StatusCode(500);
}
detailFramework.Description = SanitizerHelper.SanitizeHtmlData(detailFramework.Description);
var newFramework = frameworkService.CreateFramework(detailFramework, adminId);
TempData.Clear();
return RedirectToAction("AddCollaborators", "Frameworks", new { actionname = "New", frameworkId = newFramework.ID });
Expand Down
1 change: 1 addition & 0 deletions DigitalLearningSolutions.Web/DigitalLearningSolutions.Web.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
<PackageReference Include="FluentMigrator.Runner.SqlServer" Version="3.2.9" />
<PackageReference Include="FuzzySharp" Version="2.0.2" />
<PackageReference Include="HtmlAgilityPack" Version="1.11.28" />
<PackageReference Include="HtmlSanitizer" Version="7.1.542" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="3.1.4" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="2.0.0" />
<PackageReference Include="Microsoft.FeatureManagement" Version="2.0.0" />
Expand Down
15 changes: 15 additions & 0 deletions DigitalLearningSolutions.Web/Helpers/SanitizerHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
namespace DigitalLearningSolutions.Web.Helpers
{
using Ganss.XSS;
public static class SanitizerHelper
{
public static string SanitizeHtmlData(string htmlData)
{
var sanitizer = new HtmlSanitizer();
sanitizer.AllowedTags.Remove("iframe");
sanitizer.AllowedTags.Remove("img");
var sanitized = sanitizer.Sanitize(htmlData);
return sanitized;
}
}
}
5 changes: 5 additions & 0 deletions DigitalLearningSolutions.Web/Scripts/frameworks/htmleditor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import { Jodit } from 'jodit';
import DOMPurify from 'dompurify';

let jodited = false;
if (jodited === false) {
Expand Down Expand Up @@ -65,5 +66,9 @@ if (jodited === false) {

if (editor != null) {
jodited = true;
editor.e.on('blur', () => {
const clean = DOMPurify.sanitize(editor.editor.innerHTML);
editor.editor.innerHTML = clean;
});
}
}
1 change: 1 addition & 0 deletions DigitalLearningSolutions.Web/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"@babel/core": "^7.18.0",
"@babel/preset-env": "^7.18.0",
"@babel/preset-typescript": "^7.17.12",
"@types/dompurify": "^2.3.3",
"@types/jest": "^27.5.1",
"@types/js-cookie": "^3.0.2",
"@types/js-search": "^1.4.0",
Expand Down
12 changes: 12 additions & 0 deletions DigitalLearningSolutions.Web/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1434,6 +1434,13 @@
resolved "https://registry.yarnpkg.com/@types/chartist/-/chartist-0.11.1.tgz#3825e6cee87f5f548e8631b2c25e3a7b597b2522"
integrity sha512-85eNd7rF+e5sLnpprgcDdeqARgNvczEXaBfnrkw0292TBCE4KF/2HmOPA6dIblyHUWV4OZ2kuQBH2R12F+VwYg==

"@types/dompurify@^2.3.3":
version "2.3.4"
resolved "https://registry.yarnpkg.com/@types/dompurify/-/dompurify-2.3.4.tgz#94e997e30338ea24d4c8d08beca91ce4dd17a1b4"
integrity sha512-EXzDatIb5EspL2eb/xPGmaC8pePcTHrkDCONjeisusLFrVfl38Pjea/R0YJGu3k9ZQadSvMqW0WXPI2hEo2Ajg==
dependencies:
"@types/trusted-types" "*"

"@types/eslint-scope@^3.7.3":
version "3.7.3"
resolved "https://registry.yarnpkg.com/@types/eslint-scope/-/eslint-scope-3.7.3.tgz#125b88504b61e3c8bc6f870882003253005c3224"
Expand Down Expand Up @@ -1553,6 +1560,11 @@
resolved "https://registry.yarnpkg.com/@types/tough-cookie/-/tough-cookie-4.0.2.tgz#6286b4c7228d58ab7866d19716f3696e03a09397"
integrity sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==

"@types/trusted-types@*":
version "2.0.2"
resolved "https://registry.yarnpkg.com/@types/trusted-types/-/trusted-types-2.0.2.tgz#fc25ad9943bcac11cceb8168db4f275e0e72e756"
integrity sha512-F5DIZ36YVLE+PN+Zwws4kJogq47hNgX3Nx6WyDJ3kcplxyke3XIzB8uK5n/Lpm1HBsbGzd6nmGehL8cPekP+Tg==

"@types/yargs-parser@*":
version "21.0.0"
resolved "https://registry.yarnpkg.com/@types/yargs-parser/-/yargs-parser-21.0.0.tgz#0c60e537fa790f5f9472ed2776c2b71ec117351b"
Expand Down