Consider stricter rich text and pages validation

huridocs / uwazi

Uwazi is a web-based, open-source solution for building and sharing document collections

http://www.uwazi.io

MIT License

242 stars 80 forks source link

Consider stricter rich text and pages validation #6896

Open txau opened 5 months ago

txau commented 5 months ago

While we have some basic validation for problematic HTML and potential security issues within rich text fields and pages, it would be advisable relying in something like https://github.com/cure53/DOMPurify.

Derived from: https://github.com/huridocs/uwazi/issues/6894

mfacar commented 1 month ago

DOMPurify has some restrictions related to ESM, #7206 added sanitize-html, it is lighter and easier to use, to sanitize markdown properties inputs from metadata edition and public forms, the pages however, don't have this control since could be breaking the admin-defined pages if some attribute is not specified in the white list.