Make DOMPurify work in Node.js #29

fhemberger · 2014-07-06T12:42:36Z

Regarding issue #26 and #27, I originally held back Common JS style exports and publishing on npm on purpose, as DOMPurify doesn't run on a pure Node.js environment (it does client side with Browserify).

I'm still looking for a way to get it to work on Node.js as well. jsdom lacks DOM Level 2 Traversal methods like createNodeIterator at the moment, which DOMPurify uses internally.

What's currently missing:

document.implementation.createHTMLDocument
(polyfilled with return jsdom('<html><body></body></html>');)
`window.NodeFilter (extracted the properties needed for DOMPurify from the spec)
document.createNodeIterator(root, whatToShow, filter, entityReferenceExpansion)
NodeIterator.nextNode() implementation
Setter method for document.body.outerHTML

The text was updated successfully, but these errors were encountered:

fhemberger · 2014-07-06T15:32:44Z

I'm currently trying to implement the NodeIterator myself.

cure53 · 2014-10-04T12:49:44Z

Is there any news on this one?

fhemberger · 2014-10-04T14:22:19Z

Nope, sorry. Didn't have time during the last months to work on the NodeIterator. It's still on my list.

dashed · 2014-10-22T04:48:15Z

Sighs.

Was wondering why I was getting this error.

/path/to/node_modules/dompurify/purify.js:405
        if(typeof document.implementation.createHTMLDocument === 'undefined') 
                  ^
ReferenceError: document is not defined
...

Please don't host DOMPurify on npm if it's not going to work on node.js env; it's not a package manager for libraries that conveniently support CommonJS.

fhemberger · 2014-10-22T05:40:01Z

npm is not a package manager exclusively for Node.js modules (Please read about the npm 2.0 release).
Also, DOMpurify works great with Browserify, that's why it's on npm.

fhemberger · 2014-10-25T15:59:56Z

Today, I've sent a PR to the jsdom project to include add document.implementation.createHTMLDocument() to living standard.

You were right @cure53, dealing with DOM implementations is really a mess. ;)

dashed · 2014-10-25T22:16:33Z

Hmmm. Are you planning on adding jsdom as a dependency?

Would it be possible to use cheerio as an alternative?

fhemberger · 2014-10-26T05:19:16Z

Cheerio is a jQuery-like HTML parser, not a DOM implementation (which we need, e.g. for createHTMLDocument, NodeFilter, NodeIterator, etc.).

cure53 · 2014-10-26T15:12:13Z

@fhemberger Nice!

Would that mean that w ecan make DOMPurify happen in combination with jsdom? Or do we need to start creating a feature table of missing APIs and work our way through them?

fhemberger · 2014-10-27T04:34:42Z

NodeFilter and NodeIterator are still missing in jsdom. NodeFilter is just a bunch of constants, NodeIterator is a tiny bit more complex. ;) Both should pass W3C's implementation tests as well.

Then we should be able to use DOMPurify together with jsdom for Node.js.

dashed · 2014-10-27T18:11:38Z

I have a feeling this can be done without jsdom. DOMPurify caught my attention because of its performance characteristics; and jsdom may slow things down a lot.

fhemberger · 2014-10-27T18:16:00Z

Well, if you know of a different DOM implementation and you can get DOMPurify working with it, we'd happily accept a pull request. At the moment, jsdom is the only thing that comes to my mind …

cure53 · 2014-10-27T18:35:12Z

@dashed I fully agree with @fhemberger, if there was a way to do it w/o jsdom: awesome :)

Using DOMPurify with node.js opens many many new doors.

Shipow · 2014-11-12T00:20:50Z

Would be really awesome to have it run in full node.js env. Looking forward to see that happening! Good luck guys!

fhemberger · 2014-11-12T07:20:42Z

I'm already pushing updates to jsdom, I'll have a bit more time in December so I hope we can close this issue by the end of the year. ;)

wtfuii · 2015-02-11T11:27:50Z

+1 for this feature..

Joris-van-der-Wel · 2015-04-23T16:03:23Z

jsdom 5.1.0 supports NodeIterator: jsdom/jsdom#1092
There are still other issues though, such as firstElementChild

fhemberger · 2015-04-23T22:11:35Z

Thanks, I read the announcement (but hadn't notice the version has already been released).
I hope to find the time soon to look into this topic again. Sorry this takes so long, but fiddling around with a DOM implementation in Node is really messy. ;)

Joris-van-der-Wel · 2015-04-27T16:55:00Z

jsdom 5.2.0 has many fixes to make dompurify work. Most html snippets can now be "purified" properly.
Although I have to load dompurify as a script using jsdom.env because dompurify uses a lot of globals. It would be great if I could instantiate dompurify by passing it a Window.

There are still a few test cases failing though, which would require more work in jsdom. One example is that jsdom currently throws an exception if an attribute is set with an invalid name: foo.innerHTML = "<img id/=' >". The spec says that resolving parser errors is optional, but it is of course not how the browsers behave. The result is that dompurify is not able to clean up such snippets.

Joris-van-der-Wel · 2015-05-17T13:44:44Z

Above has been fixed. There are now 13 failing test cases.
Additional stuff to fix in jsdom:

A few test cases with svg tags fail, the output looks safe, but it is not what the test cases expect
stub or implement adoptNode
stub or implement activeElement
Do not throw if the style attribute contains invalid CSS: https://github.com/chad3814/CSSStyleDeclaration/issues/30
Implement insertAdjacentHTML (required if you want to use KEEP_CONTENT)

fhemberger · 2015-05-18T06:02:31Z

Thanks @Joris-van-der-Wel for digging into this, looks like we're getting closer.
Unfortunately, I'm pretty occupied at the moment, so I'm not able to dive into the jsdom code right now to implement the missing features. 😞

cure53 · 2015-05-18T08:52:24Z

A quick question: I think we are close to the next release. Should we go ahead or wait for you guys? Not sure how far this ticket is in total, thus asking :)

fhemberger · 2015-05-18T08:58:52Z

No, don't wait for me. Just go ahead and release it. Node support would be a major version increment anyway.

Joris-van-der-Wel · 2015-05-20T22:45:20Z

As for releasing:
I do not think that any XSS attempts will get through if you use jsdom with these unresolved issues. The effects of these issues are:

adoptNode, activeElement and maybe others that are not in the test cases may get clobbered if you only filter using jsdom. These are not causing XSS leaks.
~~Invalid CSS in style tags will throw. For example if DOMPurify is used in a node http server, it would give clients a 500 error instead of the sanitized html.~~
The KEEP_CONTENT option does not work at all

The only thing I am not sure about yet are the 2 cases (87 and 173) that fail with svg content. I have not looked at those extensively. Perhaps all those need are an additional "expected" value in the test case itself.

Here is the output of the test cases: https://joris-van-der-wel.github.io/DOMPurify-04d7218-on-jsdom-5.4.0.html and here is the script I used to generate this https://joris-van-der-wel.github.io/DOMPurify-test-jsdom.js

Joris-van-der-Wel · 2015-05-20T22:49:04Z

So if none of those issues can cause a security issue, I would say, release it

dhardtke · 2015-05-27T15:52:41Z

So will 0.6.4 support NodeJS?

Joris-van-der-Wel · 2015-05-27T16:06:09Z

It supports iojs. (nodejs will be supported in the near future because iojs and nodejs are merging).

Try this:

npm install cure53/DOMPurify jsdom

var document = require('jsdom').jsdom();
var dompurify = require('dompurify')(document.defaultView);
console.log(dompurify.sanitize(`
        hell <script>alert("hi");</script>
        <div onclick="alert(123);">
                o
        </div>
        world
        <img id="createElement">
`));

fhemberger · 2015-05-27T17:37:38Z

I'm so grateful for your help so we finally got this out. Thanks!

fhemberger · 2015-06-05T05:42:16Z

I haven't had the time for testing it, but can we close this issue now?

Joris-van-der-Wel · 2015-06-05T09:30:56Z

Well, enabling KEEP_CONTENT has no effect now. Beyond that, I can imagine wanting to add a test runner in DOMPurify for jsdom (also see #61).

And the readme will need updating

fhemberger · 2015-06-16T20:14:08Z

Updated the README just now: 6b0c682.
I'm closing this issue now and create a new issue for KEEP_CONTENT.

CaptainN · 2019-02-23T07:41:05Z

In case anyone else comes looking - to make current jsdom work (Feb 2019):

import { JSDOM } from 'jsdom'
import DOMPurify from 'dompurify'
const { window } = new JSDOM('<!DOCTYPE html>')
const domPurify = DOMPurify(window)
console.log(domPurify.sanitize(`
        hell <script>alert("hi");</script>
        <div onclick="alert(123);">
                o
        </div>
        world
        <img id="createElement">
`));

kkomelin · 2020-03-18T15:18:28Z

@CaptainN Thanks for your solution.
I've gone further and created an isomorphic wrapper which allows using DOMPurify on both frontend and backend seamlessly https://github.com/kkomelin/isomorphic-dompurify
I would appreciate your feedback on the wrapper.

EddyVinck · 2020-04-06T15:02:51Z

I just stumbled upon this problem. I found a lightweight alternative for a simple DOMPurify use-case that works in Node: https://github.com/leizongmin/js-xss

import xss from 'xss';

export function sanitizeText(string) {
  // only include whitelisted tags, remove the others
  return xss(string, { whiteList: ['b', 'i', 'strong'], stripIgnoreTag: true });
}

It has to be lightweight because I'm using it with server-side rendered React, which runs in Node first but then runs in the browser.

kkomelin · 2020-04-06T16:18:52Z

@EddyVinck There are a few xss-filtering solutions on NPM, you're free to use any of them.

What led me to DOMPurify is this presentation Building Secure React Applications by Philippe De Ryck. Since you're working with React, it may interest you too.

etiennejcharles · 2020-06-09T23:01:43Z

Well seems like a port was created 2 months ago
https://github.com/kkomelin/isomorphic-dompurify#readme

Otherwise the tests break. See cure53/DOMPurify#29

* Sanitize email HTML to prevent XSS Fixes #457 * Replace dompurify with isomorphic-dompurify as per cure53/DOMPurify#29 * Switch to dompurify and make it work server-side on our own.

Using DOMPurify as in a guide produces an error because JEST do not have access to window object, so I applied the solution linked below: cure53/DOMPurify#29 (comment)

* Allow anchors in banner's description * Fetch JITMs on the "All posts" page * Fix a failed client-side test Using DOMPurify as in a guide produces an error because JEST do not have access to window object, so I applied the solution linked below: cure53/DOMPurify#29 (comment) * Fix tests by removing JSDOM usage Recently I've used JSDOM to imitate window object presence to overcome JEST tests falling since JEST uses node environment. Eventually it turned into a webpack breakage. The solution is in mocking DOMPurify. * Add missed dependency * Change JITM's message path Recently I used an incorrect message path and did not notice it because previously I mocked response from public-api.wordpress.com. * Remove isJetpack condition for Blaze's JITM since the current site might be connected to Jetpack.

fhemberger added the enhancement label Jul 6, 2014

fhemberger added a commit that referenced this issue Oct 22, 2014

Clarify status of Node.js support, see #29

19b86d1

Joris-van-der-Wel mentioned this issue May 29, 2015

Update _isClobbered to check currently required properties #64

Merged

fhemberger mentioned this issue Jun 16, 2015

Flag KEEP_CONTENT has no effect on io.js #80

Closed

fhemberger closed this as completed Jun 16, 2015

Joris-van-der-Wel mentioned this issue Sep 17, 2015

Test DOMPurify with a Browser grid #61

Closed

ChristopherGillis mentioned this issue Aug 9, 2019

TypeError: dompurify_1.default.sanitize is not a function #353

Closed

omarryhan mentioned this issue May 21, 2020

Typescript bug on Node JS when using this lib with JSDOM #437

Closed

MonkeyDo added a commit to akashgp09/bookbrainz-site that referenced this issue May 3, 2021

Replace dompurify with isomorphic-dompurify

b769b76

Otherwise the tests break. See cure53/DOMPurify#29

eharkins mentioned this issue Jun 4, 2021

parse /groups/:groupName markdown; nextstrain/nextstrain.org#345

Merged

LeSuisse mentioned this issue Dec 1, 2021

Dompurify issue with Nuxt bridge - dompurify_1.sanitize is not a function LeSuisse/vue-dompurify-html#1521

Closed

vhscom mentioned this issue May 27, 2022

Support for Node and TypeScript #691

Closed

BrunoBernardino added a commit to padloc/padloc that referenced this issue Jun 21, 2022

Replace dompurify with isomorphic-dompurify as per cure53/DOMPurify#29

bdb3d55

BrunoBernardino mentioned this issue Jun 21, 2022

Sanitize email HTML to prevent XSS padloc/padloc#478

Merged

Make DOMPurify work in Node.js #29

Make DOMPurify work in Node.js #29

Comments

fhemberger commented Jul 6, 2014

fhemberger commented Jul 6, 2014

cure53 commented Oct 4, 2014

fhemberger commented Oct 4, 2014

dashed commented Oct 22, 2014

fhemberger commented Oct 22, 2014

fhemberger commented Oct 25, 2014

dashed commented Oct 25, 2014

fhemberger commented Oct 26, 2014

cure53 commented Oct 26, 2014

fhemberger commented Oct 27, 2014

dashed commented Oct 27, 2014

fhemberger commented Oct 27, 2014

cure53 commented Oct 27, 2014

Shipow commented Nov 12, 2014

fhemberger commented Nov 12, 2014

wtfuii commented Feb 11, 2015

Joris-van-der-Wel commented Apr 23, 2015

fhemberger commented Apr 23, 2015

Joris-van-der-Wel commented Apr 27, 2015

Joris-van-der-Wel commented May 17, 2015

fhemberger commented May 18, 2015

cure53 commented May 18, 2015

fhemberger commented May 18, 2015

Joris-van-der-Wel commented May 20, 2015

Joris-van-der-Wel commented May 20, 2015

dhardtke commented May 27, 2015

Joris-van-der-Wel commented May 27, 2015

fhemberger commented May 27, 2015

fhemberger commented Jun 5, 2015

Joris-van-der-Wel commented Jun 5, 2015

fhemberger commented Jun 16, 2015

CaptainN commented Feb 23, 2019

kkomelin commented Mar 18, 2020

EddyVinck commented Apr 6, 2020 • edited

kkomelin commented Apr 6, 2020 • edited

etiennejcharles commented Jun 9, 2020

EddyVinck commented Apr 6, 2020 •

edited

kkomelin commented Apr 6, 2020 •

edited