improve xss security

[mojoaxel]

I added the xss library to improve security.

fixes #838

[yotamberk]

In some of the files util is not imported

[vis-bot]

🎉 This PR is included in version 7.4.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[Donov4n]

Hello :)

Its seems that this PR has introduced a regression because the xss dep. has only been added
to devDeps and is therefore not available when consuming vis-timeline.

The error :

This dependency was not found:

* xss in ./node_modules/vis-timeline/esnext/esm/vis-timeline-graph2d.js

To install it, you can run: npm install --save xss

Should i open a new issue for this ?

[Thomaash]

Hi there,

I know this is already out as a fix but this is a breaking change. XSS is basically nuking the HTML away with an extremely constrained set of exceptions. There are no forms, no classes, no styles etc. Also the thing has like 30K and for what? So that people can have the convenience of <h2>Heading</h2><p>Text…</p>? This doesn't seem worth it to me (though as always, this is up for discussion). If we really want to sanitize this and since we allow for HTMLElement to be used as a title, I would just use innerText for strings and changed the docs so that the people who want HTML in there would be instructed to pass HTMLElement (maybe using innerHTML there, if they choose to) instead of a string.

Another thing is that the configurator (which is except for reformatting identical to the code in Vis Network and really should be moved to Vis Util) doesn't really use HTML (apart from some simple wrapping, but we don't need innerHTML for that), it can be quite easily converted to innerText and no sanitation is necessary at all.

[mojoaxel]

@Donov4n Sorry!
@Thomaash Thanks!

[ckeboss]

I agree with @Thomaash, shouldn't sanitization be up to the user?

For example, setting a tooltip template is now pretty useless, as you can not input any attributes to elements.

[ge0ffrey]

Solution to allow classes, styles etc in elements (based on the changes that they made resolving this issue)

const options = {
    xss: {disabled: true}
}

Be wary of XSS in this case, of course.