feat(CCP-3924): sanitize HTML in DevX message connector custom node

community-nodes/nodes/DevXMessageConnector/sources/Html/index.ts

@@ -1,15 +1,74 @@
 import { IExecuteFunctions } from 'n8n-workflow';
 import type { HtmlMessageContent } from './types';
+import sanitizeHtml from 'sanitize-html';
 
 export function htmlTransform(this: IExecuteFunctions, index: number): HtmlMessageContent {
   const rawPayload = this.getNodeParameter('payload', index);
   const payload = typeof rawPayload === 'string' ? rawPayload : JSON.stringify(rawPayload);
   return createHtmlMessageContent(payload);
 }
 
+const config: sanitizeHtml.IOptions = {
+  // Teams only supports a small subset of HTML
+  allowedTags: [
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'blockquote',
+    'p',
+    'ul',
+    'ol',
+    'li',
+    'hr',
+    'br',
+    'div',
+    'span',
+    'pre',
+    'code',
+    'b',
+    'i',
+    'strong',
+    'em',
+    'u',
+    's',
+    'a',
+    'table',
+    'thead',
+    'tbody',
+    'tr',
+    'th',
+    'td',
+    'img',
+  ],
+  allowedAttributes: {
+    a: ['href', 'title', 'target'],
+    img: ['src', 'alt', 'title', 'width', 'height'],
+    span: ['style'],
+    p: ['style'],
+    div: ['style'],
+  },
+  allowedStyles: {
+    '*': {
+      color: [/^#(?:[0-9a-fA-F]{3}){1,2}$/, /^(rgb|hsl)a?\([^)]*\)$/, /^[\w-]+$/],
+      'background-color': [/^#(?:[0-9a-fA-F]{3}){1,2}$/],
+      'text-align': [/^left$/, /^right$/, /^center$/, /^justify$/],
+      'font-weight': [/^\d+$/, /^bold$/, /^normal$/],
+    },
+  },
+  allowedSchemes: ['http', 'https', 'mailto', 'tel'],
+  allowedSchemesAppliedToAttributes: ['href', 'src'],
+  allowProtocolRelative: false,
+  disallowedTagsMode: 'discard',
+  parseStyleAttributes: true,
+};
+
 export function createHtmlMessageContent(html: string): HtmlMessageContent {
+  const sanitizedHtml = sanitizeHtml(html, config);
   return {
     kind: 'html',
-    text: html,
+    text: sanitizedHtml,
   };
 }

community-nodes/package.json

@@ -36,11 +36,15 @@
   "devDependencies": {
     "@n8n/node-cli": "*",
     "@types/node": "^25.2.0",
+    "@types/sanitize-html": "^2.16.1",
     "eslint": "9.32.0",
     "typescript": "5.9.2",
     "zod": "^4.3.6"
   },
   "peerDependencies": {
     "n8n-workflow": "*"
+  },
+  "dependencies": {
+    "sanitize-html": "^2.17.2"
   }
 }