diff --git a/front/assets/js/flaky_tests/components/actions.tsx b/front/assets/js/flaky_tests/components/actions.tsx index 60579b4d8..c13341a5d 100644 --- a/front/assets/js/flaky_tests/components/actions.tsx +++ b/front/assets/js/flaky_tests/components/actions.tsx @@ -10,6 +10,7 @@ import * as types from "../types"; import { auto } from "@popperjs/core"; import { Headers } from "../network/request"; import * as marked from "marked"; +import DOMPurify from "dompurify"; export const Actions = ({ item }: { item: FlakyTestItem, }) => { const config = useContext(stores.Config.Context); @@ -157,7 +158,18 @@ const TicketDetail = (props: TicketDetailProps) => { **Commit**: ${props.item.latestDisruptionSha()} **File**: ${props.item.testFile}`; - return marked.parse(markdown); + + const rawHtml = marked.parse(markdown); + return DOMPurify.sanitize(rawHtml, { + ALLOWED_TAGS: [ + `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, + `p`, `br`, `strong`, `em`, `u`, `strike`, + `ul`, `ol`, `li`, + `blockquote`, `code`, `pre` + ], + ALLOWED_ATTR: [`title`], + ALLOWED_SCHEMES: [`http`, `https`, `mailto`] + }); };