Skip to content

Commit 312d923

Browse files
committed
convert embeds to a tags
1 parent b9fc5c5 commit 312d923

File tree

4 files changed

+109
-247
lines changed

4 files changed

+109
-247
lines changed

package-lock.json

Lines changed: 13 additions & 149 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
},
5454
"dependencies": {
5555
"body-parser": "~1.18.2",
56+
"cheerio": "^1.0.0-rc.2",
5657
"compression": "~1.7.1",
5758
"cors": "~2.8.4",
5859
"crypto": "~1.0.1",
@@ -102,6 +103,7 @@
102103
"mongoose": "~4.13.2",
103104
"multer": "~1.3.0",
104105
"node-sass": "~4.7.2",
106+
"quill-url-embeds": "https://github.com/Human-Connection/quill-url-embeds.git",
105107
"raven": "~2.4.0",
106108
"request": "~2.83.0",
107109
"request-promise": "~4.2.2",

server/hooks/xss.js

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,19 @@
11
const sanitizeHtml = require('sanitize-html');
2+
// const utils = require('quill-url-embeds');
23
const _ = require('lodash');
4+
const cheerio = require('cheerio');
35

46
function clean (dirty) {
7+
// Convert embeds to a-tags
8+
// dirty = utils.embedToAnchor(dirty);
9+
const $ = cheerio.load(dirty);
10+
$('div[data-url-embed]').each((i, el) => {
11+
let url = el.attribs['data-url-embed'];
12+
let aTag = $(`<a href="${url}" target="_blank">${url}</a>`);
13+
$(el).replaceWith(aTag);
14+
})
15+
dirty = $('body').html();
16+
517
dirty = sanitizeHtml(dirty, {
618
allowedTags: ['iframe', 'img', 'p', 'br', 'b', 'i', 'em', 'strong', 'a', 'pre', 'ul', 'li', 'ol', 'span'],
719
allowedAttributes: {

0 commit comments

Comments
 (0)