search

cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
https://cure53.de/purify
Other
13.97k stars 723 forks source link

DOMPurify 2.4.5 and whtmltopdf 0.12.6 #812

Closed francoisjacquet closed 1 year ago

francoisjacquet commented 1 year ago

Hello,

I have been trying to use DOMPurify with wkhtmltopdf.

The DOMPurify.isSupported property is set to true.

But the sanitize() function returns an empty string.

The same code is OK inside the browser and returns HTML.

I know wkhtmltopdf uses QtWebkit, any hints why we have this behavior?

Note: I have tried with DOMPurify 3.0.3 and the DOMPurify.sanitize` seems to trigger an error as I can't seem to get any further.

cure53 commented 1 year ago

Hmmm, good question! Can you set a break-point in sanitize() and check where the string content gets voided?

If it's really our bug, we'd love to fix it very quickly. But we need your help with the debugging.

cure53 commented 1 year ago

We had a closer look and indeed the wkhtmltopdf JavaScript support is a bit rusty, latest versions of DOMPurify do not work properly with the old engine that is being used :sweat_smile:

However, slightly older versions still work:

<body>
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.1/purify.js"></script>
<script>
var html = "<h1>GOODBYE</h1>";
document.write(DOMPurify.sanitize(html));
</script>
<h2>Hello</h2>

and $ wkhtmltopdf --debug-javascript --javascript-delay 500 --enable-javascript --no-stop-slow-scripts basic-demo.html dompurify.pdf

work as expected, hope that helps :smile: