Merge pull request #3620 from RedisInsight/fe/bugfix/RI-5936

#RI-5936 - update sanitizer

Author: vlad-dargel

redisinsight/ui/src/utils/formatters/markdown/remarkSanitize.ts

@@ -1,5 +1,9 @@
 import { visit } from 'unist-util-visit'
 
+const permittedAttibutes = [
+  'dangerouslySetInnerHTML'
+]
+
 const dangerousAttributes = [
   'onabort', 'onafterprint', 'onanimationend', 'onanimationiteration', 'onanimationstart',
   'onbeforeprint', 'onbeforeunload', 'onblur', 'oncancel', 'oncanplay', 'oncanplaythrough',
@@ -17,10 +21,27 @@ const dangerousAttributes = [
   'background', 'poster', 'cite', 'data', 'ping', 'xlink:href', 'style', 'srcdoc', 'sandbox'
 ].join('|')
 
+// Define an array of potentially dangerous tags
+const dangerousTags = ['script', 'iframe', 'object', 'embed', 'link', 'style', 'meta']
+
 export const remarkSanitize = (): (tree: Node) => void => (tree: any) => {
   visit(tree, 'html', (node) => {
-    const dangerousAttrRegex = new RegExp(`\\s*(${dangerousAttributes})="[^"]*"`, 'gi')
+    const inputTag = node.value.toLowerCase()
+
+    // remove dangerous tags
+    if (dangerousTags.some((tag) => inputTag.startsWith(`<${tag}`))) {
+      node.value = ''
+      return
+    }
+
+    // remove permitted attributes
+    if (permittedAttibutes.some((attr) => node.value.includes(`${attr}=`))) {
+      node.value = ''
+      return
+    }
 
+    // sanitize dangerous attributes
+    const dangerousAttrRegex = new RegExp(`\\s*(${dangerousAttributes})="[^"]*"`, 'gi')
     if (node.value.match(dangerousAttrRegex)) {
       node.value = node.value.replace(dangerousAttrRegex, (match: string) => {
         const attr = match.toLowerCase().trim()

redisinsight/ui/src/utils/tests/formatters/markdown/remarkSanitize.spec.ts

@@ -10,6 +10,8 @@ const testCases = [
   { input: '<img onload="alert(1)">', output: '<img>' },
   { input: '<img src="javascript:alert(1)">', output: '<img>' },
   { input: '<img src="img.png">', output: '<img src="img.png">' },
+  { input: '<div dangerouslySetInnerHTML={{"__html": "<img src=x onerror=alert(\'this.still.works\')>"}} />', output: '' },
+  { input: '<script>', output: '' },
 ]
 
 describe('remarkSanitize', () => {