Utilize DOMPurify hooks to preserve <use> elements in playground mode #156
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
HackbrettXXX
requested changes
Oct 6, 2020
playground/index.js
Outdated
| @@ -1,6 +1,12 @@ | |||
| const { jsPDF } = window.jspdf | |||
| const DOMPurify = window.DOMPurify | |||
|
|
|||
| DOMPurify.addHook('afterSanitizeAttributes', node => { | |||
| if(node.hasAttribute('xlink:href') && !node.getAttribute('xlink:href').match(/^#/)) { | |||
There was a problem hiding this comment.
We should also check the href attribute without the xlink namespace.
There was a problem hiding this comment.
Good point, I didn't know that it is deprecated in SVG 2. I have amended the commit and also added playground to prettier check.
listopadiya
force-pushed
the
bugfix/playgound-use-tag
branch
from
ff40942
to
7a86f13
Compare
HackbrettXXX
requested changes
Oct 6, 2020
package.json
Outdated
| @@ -25,7 +25,7 @@ | |||
| "test-typescript": "karma start ./test/deployment/typescript/karma.conf.js", | |||
| "test:ci": "cross-env SHOW_DIFF=true npm run test", | |||
| "createreferences": "node test/common/reference-server.js", | |||
| "prettier": "prettier --write {src,tests,typings}/**/*.{ts,js}", | |||
| "prettier": "prettier --write {playground,src,tests,typings}/**/*.{ts,js}", | |||
| "lint": "eslint {src,tests,typings}/**/*.{ts,js}" | |||
There was a problem hiding this comment.
Sorry for nitpicking, but we should also add it to the lint task then.
There was a problem hiding this comment.
Makes sense, I updated that 👌
listopadiya
force-pushed
the
bugfix/playgound-use-tag
branch
from
7a86f13
to
9880623
Compare
HackbrettXXX
approved these changes
Oct 6, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #155.
<use>tags were filtered out after sanitization, but with DOMPurify hooks this problem can be solved (regular expression still filter out links to external resources in the interest of security).Can be checked in playground with following SVG code:
Before PR
After PR
