moon
/
ditto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize oembed html

This commit is contained in:
Alex Gleason 2023-05-27 16:40:18 -05:00
parent 74024e36b6
commit 265a97a191
No known key found for this signature in database
GPG Key ID: 7211D1F99744FBB7
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/deps.ts
View File

@ -34,3 +34,5 @@ export { default as mime } from 'npm:mime@^3.0.0';
export { unfurl } from 'npm:unfurl.js@^6.3.2';
export { default as TTLCache } from 'npm:@isaacs/ttlcache@^1.4.0';
export { default as uuid62 } from 'npm:uuid62@^1.0.2';
// @deno-types="npm:@types/sanitize-html@2.9.0"
export { default as sanitizeHtml } from 'npm:sanitize-html@^2.10.0';

9
src/transmute.ts
View File

@ -1,4 +1,4 @@
import { findReplyTag, lodash, nip19, TTLCache, unfurl, z } from '@/deps.ts';
import { findReplyTag, lodash, nip19, sanitizeHtml, TTLCache, unfurl, z } from '@/deps.ts';
import { type Event } from '@/event.ts';
import { emojiTagSchema, filteredArray, type MetaContent, parseMetaContent } from '@/schema.ts';
@ -211,7 +211,12 @@ async function unfurlCard(url: string): Promise<PreviewCard | null> {
provider_name: result.oEmbed?.provider_name || '',
provider_url: result.oEmbed?.provider_url || '',
// @ts-expect-error `html` does in fact exist on oEmbed.
html: result.oEmbed?.html || '',
html: sanitizeHtml(result.oEmbed?.html || '', {
allowedTags: ['iframe'],
allowedAttributes: {
iframe: ['width', 'height', 'src', 'frameborder', 'allowfullscreen'],
},
}),
width: result.oEmbed?.width || 0,
height: result.oEmbed?.height || 0,
image: result.oEmbed?.thumbnails?.[0].url || result.open_graph.images?.[0].url || null,