rimmel/dist/esm/sinks/sanitize-html-sink.js

A Stream-Oriented UI library for the Rx.Observable Universe

import { SINK_TAG } from '../constants.js';

const isElement = (node) => node.nodeType == Node.ELEMENT_NODE;
const sanitizeNode = (node) => {
    if (isElement(node)) {
        const forbiddenTags = ['script', 'style', 'iframe', 'object', 'embed'];
        if (forbiddenTags.includes(node.tagName.toLowerCase())) {
            node.remove();
            return;
        }
        const forbiddenAttributes = ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur', 'onkeydown', 'onkeypress', 'onkeyup'];
        Array.from(node.attributes).forEach(attr => {
            if (forbiddenAttributes.includes(attr.name.toLowerCase()) || attr.name.toLowerCase().startsWith('on')) {
                node.removeAttribute(attr.name);
            }
        });
    }
    Array.from(node.children).forEach(child => sanitizeNode(child));
};
function sanitizeInput(target, input) {
    const tempElement = document.createElement('div');
    // tempElement.textContent = input;
    tempElement.innerHTML = input;
    const fragment = document.createDocumentFragment();
    fragment.append(...tempElement.childNodes);
    sanitizeNode(fragment);
    target.innerHTML = '';
    target.appendChild(fragment);
}
const SanitizeSink = (e) => sanitizeInput.bind(null, e);
//(html: HTMLString) => sanitizeInput(html, node)
const Sanitize = (source) => ({
    type: SINK_TAG,
    t: 'Sanitize',
    source,
    sink: SanitizeSink,
});

export { Sanitize, SanitizeSink };
//# sourceMappingURL=sanitize-html-sink.js.map