From d4a029b35b26e513715c9c0dedd8d297f7bbd528 Mon Sep 17 00:00:00 2001
From: Alex Gleason <alex@alexgleason.me>
Date: Tue, 21 May 2024 12:44:54 -0500
Subject: [PATCH] sanitize-html -> isomorphic-dompurify

---
 deno.json           |  1 +
 src/deps.ts         |  2 --
 src/utils/unfurl.ts | 10 ++++------
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/deno.json b/deno.json
index 1ebc35e..316c65b 100644
--- a/deno.json
+++ b/deno.json
@@ -43,6 +43,7 @@
     "hono": "https://deno.land/x/hono@v3.10.1/mod.ts",
     "hono/middleware": "https://deno.land/x/hono@v3.10.1/middleware.ts",
     "iso-639-1": "npm:iso-639-1@2.1.15",
+    "isomorphic-dompurify": "npm:isomorphic-dompurify@^2.11.0",
     "kysely": "npm:kysely@^0.27.3",
     "kysely_deno_postgres": "https://deno.land/x/kysely_deno_postgres@v0.4.0/mod.ts",
     "linkify-plugin-hashtag": "npm:linkify-plugin-hashtag@^4.1.1",
diff --git a/src/deps.ts b/src/deps.ts
index dc9d912..ae96034 100644
--- a/src/deps.ts
+++ b/src/deps.ts
@@ -1,6 +1,4 @@
 import 'deno-safe-fetch';
-// @deno-types="npm:@types/sanitize-html@2.9.0"
-export { default as sanitizeHtml } from 'npm:sanitize-html@^2.11.0';
 export {
   type ParsedSignature,
   pemToPublicKey,
diff --git a/src/utils/unfurl.ts b/src/utils/unfurl.ts
index b028be5..e5ae428 100644
--- a/src/utils/unfurl.ts
+++ b/src/utils/unfurl.ts
@@ -1,8 +1,8 @@
 import TTLCache from '@isaacs/ttlcache';
 import Debug from '@soapbox/stickynotes/debug';
+import DOMPurify from 'isomorphic-dompurify';
 import { unfurl } from 'unfurl.js';
 
-import { sanitizeHtml } from '@/deps.ts';
 import { Time } from '@/utils/time.ts';
 import { fetchWorker } from '@/workers/fetch.ts';
 
@@ -44,11 +44,9 @@ async function unfurlCard(url: string, signal: AbortSignal): Promise<PreviewCard
       provider_name: oEmbed?.provider_name || '',
       provider_url: oEmbed?.provider_url || '',
       // @ts-expect-error `html` does in fact exist on oEmbed.
-      html: sanitizeHtml(oEmbed?.html || '', {
-        allowedTags: ['iframe'],
-        allowedAttributes: {
-          iframe: ['width', 'height', 'src', 'frameborder', 'allowfullscreen'],
-        },
+      html: DOMPurify.sanitize(oEmbed?.html || '', {
+        ALLOWED_TAGS: ['iframe'],
+        ALLOWED_ATTR: ['src', 'width', 'height', 'frameborder', 'allowfullscreen'],
       }),
       width: ((oEmbed && oEmbed.type !== 'link') ? oEmbed.width : 0) || 0,
       height: ((oEmbed && oEmbed.type !== 'link') ? oEmbed.height : 0) || 0,