|
1 | 1 | import { Inject, InjectionToken, Pipe, PipeTransform } from '@angular/core'; |
2 | 2 | import MarkdownIt from 'markdown-it'; |
3 | | -import * as sanitizeHtml from 'sanitize-html'; |
| 3 | +import * as DOMPurify from 'isomorphic-dompurify'; |
4 | 4 | import { DomSanitizer, SafeHtml } from '@angular/platform-browser'; |
5 | 5 | import { environment } from '../../../environments/environment'; |
6 | 6 |
|
@@ -46,38 +46,6 @@ export class MarkdownPipe implements PipeTransform { |
46 | 46 | if (environment.markdown.mathjax) { |
47 | 47 | md.use(await this.mathjax); |
48 | 48 | } |
49 | | - return this.sanitizer.bypassSecurityTrustHtml( |
50 | | - sanitizeHtml(md.render(value), { |
51 | | - // sanitize-html doesn't let through SVG by default, so we extend its allowlists to cover MathJax SVG |
52 | | - allowedTags: [ |
53 | | - ...sanitizeHtml.defaults.allowedTags, |
54 | | - 'mjx-container', 'svg', 'g', 'path', 'rect', 'text' |
55 | | - ], |
56 | | - allowedAttributes: { |
57 | | - ...sanitizeHtml.defaults.allowedAttributes, |
58 | | - 'mjx-container': [ |
59 | | - 'class', 'style', 'jax' |
60 | | - ], |
61 | | - svg: [ |
62 | | - 'xmlns', 'viewBox', 'style', 'width', 'height', 'role', 'focusable', 'alt', 'aria-label' |
63 | | - ], |
64 | | - g: [ |
65 | | - 'data-mml-node', 'style', 'stroke', 'fill', 'stroke-width', 'transform' |
66 | | - ], |
67 | | - path: [ |
68 | | - 'd', 'style', 'transform' |
69 | | - ], |
70 | | - rect: [ |
71 | | - 'width', 'height', 'x', 'y', 'transform', 'style' |
72 | | - ], |
73 | | - text: [ |
74 | | - 'transform', 'font-size' |
75 | | - ] |
76 | | - }, |
77 | | - parser: { |
78 | | - lowerCaseAttributeNames: false, |
79 | | - }, |
80 | | - }) |
81 | | - ); |
| 49 | + return this.sanitizer.bypassSecurityTrustHtml(DOMPurify.sanitize(md.render(value))); |
82 | 50 | } |
83 | 51 | } |
0 commit comments