fix: isomorphic dompurify #8301

Author: Palanikannan1437

apps/live/package.json

@@ -32,7 +32,6 @@
     "@hocuspocus/transformer": "2.15.2",
     "@plane/decorators": "workspace:*",
     "@plane/editor": "workspace:*",
-    "@plane/utils": "workspace:*",
     "@plane/logger": "workspace:*",
     "@plane/types": "workspace:*",
     "@sentry/node": "catalog:",
@@ -46,6 +45,7 @@
     "express-ws": "^5.0.2",
     "helmet": "^7.1.0",
     "ioredis": "5.7.0",
+    "isomorphic-dompurify": "^1.8.0",
     "uuid": "catalog:",
     "ws": "^8.18.3",
     "y-prosemirror": "^1.3.7",

apps/live/src/extensions/title-update/title-utils.ts

@@ -1,4 +1,14 @@
-import { sanitizeHTML } from "@plane/utils";
+import DOMPurify from "isomorphic-dompurify";
+
+/**
+ * Sanitizes HTML by removing all HTML tags, leaving only text content
+ * @param htmlString - The HTML string to sanitize
+ * @returns The sanitized text with all HTML tags removed
+ */
+const sanitizeHTML = (htmlString: string): string => {
+  const sanitizedText = DOMPurify.sanitize(htmlString, { ALLOWED_TAGS: [] }); // sanitize the string to remove all HTML tags
+  return sanitizedText.trim(); // trim the string to remove leading and trailing whitespaces
+};
 
 /**
  * Utility function to extract text from HTML content

packages/editor/package.json

@@ -66,6 +66,7 @@
     "emoji-regex": "^10.3.0",
     "highlight.js": "^11.8.0",
     "is-emoji-supported": "^0.0.5",
+    "isomorphic-dompurify": "^1.8.0",
     "jsx-dom-cjs": "^8.0.3",
     "linkifyjs": "^4.3.2",
     "lowlight": "^3.0.0",

packages/editor/src/core/helpers/yjs-utils.ts

@@ -11,7 +11,7 @@ import {
   DocumentEditorExtensionsWithoutProps,
 } from "@/extensions/core-without-props";
 import { TitleExtensions } from "@/extensions/title-extension";
-import { sanitizeHTML } from "@plane/utils";
+import DOMPurify from "isomorphic-dompurify";
 
 // editor extension configs
 const RICH_TEXT_EDITOR_EXTENSIONS = CoreEditorExtensionsWithoutProps;
@@ -207,8 +207,9 @@ export const convertHTMLDocumentToAllFormats = (args: TConvertHTMLDocumentToAllF
 };
 
 export const extractTextFromHTML = (html: string): string => {
-  // Use sanitizeHTML to safely extract text and remove all HTML tags
+  // Use DOMPurify to safely extract text and remove all HTML tags
   // This is more secure than regex as it handles edge cases and prevents injection
   // Note: sanitizeHTML trims whitespace, which is acceptable for title extraction
-  return sanitizeHTML(html) || "";
+  const sanitizedText = DOMPurify.sanitize(html, { ALLOWED_TAGS: [] }); // sanitize the string to remove all HTML tags
+  return sanitizedText.trim() || ""; // trim the string to remove leading and trailing whitespaces
 };