Properly sanitize HTML

[absidue]

Pull Request Type

• Security improvement

Description

Currently we have a mix of different ways of handling raw HTML, none of them are bulletproof. This pull request removes all uses of v-html and replaces them with a custom v-safer-html directive that uses the brand new HTML Sanitizer API which we can use with the Electron 41 upgrade and falls back to the DOMPurify library outside of Electron when the HTML Sanitizer API is not available. I went with two different sanitizing configurations a default one that is very strict that only allows the <br>, <b>, <i>, <s>, <a>, <img> elements, which is used in most places and a lenient one that uses the default Sanitizer/DOMpurify configurations that only strip dangerours things (e.g. <script> tags and inline event handlers) that is used for the changelog display.

Testing

1. Check that the About page still looks correct
2. Check that video descriptions look correct and clicking on timestamps still works (as playback is broken you don't actually need to check that it seeked, just that it scrolled to the top of the page, as that happens in the same event handler).
3. Check that comments with formatting look correct
4. Hard-code USE_NATIVE_SANITIZER to false and remove the dompurify alias in the renderer webpack config, then repeat steps 1-3

If you are unsure about what videos to use for 2 and 3, the LinusTechTips WAN show ones usually have timestamps in both the description and comments, as well as formatting in the comments.

Desktop

• OS: Windows
• OS Version: 11

[efb4f5ff-1298-471a-8973-3d47447115dc]

Hard-code USE_NATIVE_SANITIZER to false

i did

1. Check that the About page still looks correct

Doesnt seem to look correct

VirtualBoxVM_9brDMQ1gpb.mp4

2. Check that video descriptions look correct and clicking on timestamps still works (as playback is broken you don't actually need to check that it seeked, just that it scrolled to the top of the page, as that happens in the same event handler).
3. Check that comments with formatting look correct

Same here

VirtualBoxVM_pqfXE9eBOz.mp4

[absidue]

Fixed the test steps, you need to remove the dompurify override in the renderer webpack config (see second file in the diff view of this pull request).