mudhorn/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2024-11-10 06:34:05 -08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(editor): Fix Show details summary (#6113)

Browse source 
* 🐛 Fix `Show details` summary

* 🚚 Move constants out of sanitizer
This commit is contained in:
Iván Ovejero 2023-04-28 17:16:46 +02:00 committed by GitHub
parent a72a5112f3
commit 90a62ccfb5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
packages/editor-ui/src/constants.ts
View file

@ -532,3 +532,19 @@ export const TEMPLATE_EXPERIMENT = {
export const EXPERIMENTS_TO_TRACK = [TEMPLATE_EXPERIMENT.name, AUTO_INSERT_ACTION_EXPERIMENT.name]; export const EXPERIMENTS_TO_TRACK = [TEMPLATE_EXPERIMENT.name, AUTO_INSERT_ACTION_EXPERIMENT.name];
export const NODE_TYPES_EXCLUDED_FROM_OUTPUT_NAME_APPEND = [FILTER_NODE_TYPE]; export const NODE_TYPES_EXCLUDED_FROM_OUTPUT_NAME_APPEND = [FILTER_NODE_TYPE];
export const ALLOWED_HTML_ATTRIBUTES = ['href', 'name', 'target', 'title', 'class', 'id', 'style'];
export const ALLOWED_HTML_TAGS = [
'p',
'strong',
'b',
'code',
'a',
'br',
'i',
'em',
'small',
'details',
'summary',
];

9
packages/editor-ui/src/utils/htmlUtils.ts
View file

@ -1,13 +1,11 @@
import xss, { friendlyAttrValue } from 'xss'; import xss, { friendlyAttrValue } from 'xss';
import { ALLOWED_HTML_ATTRIBUTES, ALLOWED_HTML_TAGS } from '@/constants';
/* /*
Constants and utility functions that help in HTML, CSS and DOM manipulation Constants and utility functions that help in HTML, CSS and DOM manipulation
*/ */
export function sanitizeHtml(dirtyHtml: string) { export function sanitizeHtml(dirtyHtml: string) {
const allowedAttributes = ['href', 'name', 'target', 'title', 'class', 'id'];
const allowedTags = ['p', 'strong', 'b', 'code', 'a', 'br', 'i', 'em', 'small'];
const sanitizedHtml = xss(dirtyHtml, { const sanitizedHtml = xss(dirtyHtml, {
onTagAttr: (tag, name, value) => { onTagAttr: (tag, name, value) => {
if (tag === 'img' && name === 'src') { if (tag === 'img' && name === 'src') {
@ -19,8 +17,7 @@ export function sanitizeHtml(dirtyHtml: string) {
} }
} }
// Allow `allowedAttributes` and all `data-*` attributes if (ALLOWED_HTML_ATTRIBUTES.includes(name) || name.startsWith('data-')) {
if (allowedAttributes.includes(name) || name.startsWith('data-')) {
return `${name}="${friendlyAttrValue(value)}"`; return `${name}="${friendlyAttrValue(value)}"`;
} }
@ -28,7 +25,7 @@ export function sanitizeHtml(dirtyHtml: string) {
// Return nothing, means keep the default handling measure // Return nothing, means keep the default handling measure
}, },
onTag: (tag) => { onTag: (tag) => {
if (!allowedTags.includes(tag)) return ''; if (!ALLOWED_HTML_TAGS.includes(tag)) return '';
return; return;
}, },
}); });