src/enhance/sanitize.ts

Functions

Imports

It imports no other module of this repo. Imported by src/enhance/chart.ts.

Source

1/** Keeps only what Enarratio's server emits in markup handed to update() (F11). */
2
3/** The elements Enarratio's server markup is made of; update() keeps only these (F11). */
4const ALLOWED_ELEMENTS = new Set([
5  "figure",
6  "p",
7  "ul",
8  "li",
9  "span",
10  "div",
11  "figcaption",
12  "details",
13  "summary",
14  "table",
15  "caption",
16  "thead",
17  "tbody",
18  "tr",
19  "th",
20  "td",
21  "svg",
22  "g",
23  "rect",
24  "circle",
25  "ellipse",
26  "path",
27  "line",
28  "polyline",
29  "polygon",
30  "text",
31  "tspan",
32  "title",
33  "a",
34  "defs",
35  "clippath",
36]);
37const LINK_ATTRIBUTES = new Set(["href", "xlink:href"]);
38const SAFE_STYLE = /^(\s*--enarratio-[a-z0-9-]+\s*:\s*[^;{}<>]*;?)*\s*$/i;
39
40/** Relative and http(s) links only, with no user or password before the host, as the server allows (A11). */
41function safeLink(value: string): boolean {
42  const compact = [...value].filter((ch) => ch.charCodeAt(0) > 0x20).join("");
43  if (/^[/\\][/\\]/.test(compact)) return false;
44  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(compact)?.[1]?.toLowerCase();
45  if (scheme === undefined) return true;
46  if (scheme !== "http" && scheme !== "https") return false;
47  try {
48    const url = new URL(compact);
49    return url.username === "" && url.password === "";
50  } catch {
51    return false;
52  }
53}
54
55/** Removes everything the server never emits: other elements, handlers, link pings, form attributes, unsafe links and styles. */
56export function sanitize(root: Element): void {
57  for (const el of [root, ...root.querySelectorAll("*")]) {
58    if (!ALLOWED_ELEMENTS.has(el.localName.toLowerCase())) {
59      el.remove();
60      continue;
61    }
62    for (const name of el.getAttributeNames()) {
63      const value = el.getAttribute(name) ?? "";
64      const lower = name.toLowerCase();
65      if (
66        lower.startsWith("on") ||
67        (LINK_ATTRIBUTES.has(lower) && !safeLink(value)) ||
68        (lower === "style" && !SAFE_STYLE.test(value)) ||
69        lower === "srcdoc" ||
70        lower === "ping" ||
71        lower.startsWith("form")
72      ) {
73        el.removeAttribute(name);
74      }
75    }
76  }
77}