From 43500b7a4b7e254164391770746978063e7d4a56 Mon Sep 17 00:00:00 2001
From: Nick Grosenbacher <nickgrosenbacher@gmail.com>
Date: Wed, 11 Sep 2024 12:47:30 -0400
Subject: [PATCH 1/2] SWC-6762, SWC-7015

---
 package.json                                  |   4 +-
 pom.xml                                       |   2 +-
 .../web/client/SynapseJSNIUtilsImpl.java      | 100 +-----------------
 3 files changed, 4 insertions(+), 102 deletions(-)

diff --git a/package.json b/package.json
index bb7bd7ad04..d0be4f3d02 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
     "markdown-it-sup": "^2.0.0",
     "markdown-it-synapse": "^1.1.16",
     "markdown-it-synapse-heading": "^1.0.1",
-    "markdown-it-synapse-table": "^1.0.6",
+    "markdown-it-synapse-table": "^1.0.8",
     "moment": "^2.29.4",
     "papaparse": "^5.4.1",
     "pica": "6.0.0",
@@ -34,7 +34,7 @@
     "react-transition-group": "2.6.0",
     "sass": "^1.63.6",
     "spark-md5": "^3.0.2",
-    "synapse-react-client": "3.3.11",
+    "synapse-react-client": "3.3.12",
     "universal-cookie": "^4.0.4",
     "xss": "^1.0.15"
   },
diff --git a/pom.xml b/pom.xml
index 1d1c1a9fe8..23e9098e4a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -577,7 +577,7 @@
                 />
 
                 <copy
-                  file="${project.basedir}/node_modules/markdown-it-synapse-table/dist/markdown-it-synapse-table.min.js"
+                  file="${project.basedir}/node_modules/markdown-it-synapse-table/dist/index.umd.cjs"
                   tofile="src/main/webapp/generated/markdown-it-synapse-table.js"
                 />
                 <copy
diff --git a/src/main/java/org/sagebionetworks/web/client/SynapseJSNIUtilsImpl.java b/src/main/java/org/sagebionetworks/web/client/SynapseJSNIUtilsImpl.java
index 2995ed5847..82a23c951a 100644
--- a/src/main/java/org/sagebionetworks/web/client/SynapseJSNIUtilsImpl.java
+++ b/src/main/java/org/sagebionetworks/web/client/SynapseJSNIUtilsImpl.java
@@ -623,105 +623,7 @@ public String sanitizeHtml(String html) {
 
   private static final native boolean initFilterXss() /*-{
 		try {
-			var options = {
-				whiteList : {
-					a : [ 'target', 'href', 'title', 'ref' ],
-					abbr : [ 'title' ],
-					address : [],
-					area : [ 'shape', 'coords', 'href', 'alt' ],
-					article : [],
-					aside : [],
-					audio : [ 'autoplay', 'controls', 'loop', 'preload', 'src' ],
-					b : [],
-					bdi : [ 'dir' ],
-					bdo : [ 'dir' ],
-					big : [],
-					blockquote : [ 'cite' ],
-					body : [],
-					br : [],
-					caption : [],
-					center : [],
-					cite : [],
-					code : [],
-					col : [ 'align', 'valign', 'span', 'width' ],
-					colgroup : [ 'align', 'valign', 'span', 'width' ],
-					dd : [],
-					del : [ 'datetime' ],
-					details : [ 'open' ],
-					div : [ 'class' ],
-					dl : [],
-					dt : [],
-					em : [],
-					font : [ 'color', 'size', 'face' ],
-					footer : [],
-					h1 : [ 'toc' ],
-					h2 : [ 'toc' ],
-					h3 : [ 'toc' ],
-					h4 : [ 'toc' ],
-					h5 : [ 'toc' ],
-					h6 : [ 'toc' ],
-					head : [],
-					header : [],
-					hr : [],
-					html : [],
-					i : [],
-					img : [ 'src', 'alt', 'title', 'width', 'height' ],
-					ins : [ 'datetime' ],
-					li : [],
-					mark : [],
-					nav : [],
-					noscript : [],
-					ol : [],
-					p : [],
-					pre : [],
-					s : [],
-					section : [],
-					small : [],
-					span : [ 'data-widgetparams', 'class', 'id' ],
-					sub : [],
-					summary : [],
-					sup : [],
-					strong : [],
-					table : [ 'width', 'border', 'align', 'valign', 'class' ],
-					tbody : [ 'align', 'valign' ],
-					td : [ 'width', 'rowspan', 'colspan', 'align', 'valign' ],
-					tfoot : [ 'align', 'valign' ],
-					th : [ 'width', 'rowspan', 'colspan', 'align', 'valign',
-							'class' ],
-					thead : [ 'align', 'valign' ],
-					tr : [ 'rowspan', 'align', 'valign' ],
-					tt : [],
-					u : [],
-					ul : [],
-					video : [ 'autoplay', 'controls', 'loop', 'preload', 'src',
-							'height', 'width' ]
-				},
-				stripIgnoreTagBody : true, // filter out all tags not in the whitelist
-				allowCommentTag : false,
-				css : false,
-				onIgnoreTag : function(tag, html, options) {
-					if (tag === '!doctype') {
-						// do not filter doctype
-						return html;
-					}
-				},
-                safeAttrValue: function(tag, name, value) {
-                  // Apply default safeAttrValue filtering:
-                  value = $wnd.filterXSS.safeAttrValue(tag, name, value);
-                  if (tag === 'img' && name === 'src') {
-                    if (
-                      !(
-                        value &&
-                        (value.startsWith('data:image/') || value.startsWith('http'))
-                      )
-                    ) {
-                      return ''
-                    }
-                  }
-                  value = $wnd.filterXSS.escapeAttrValue(value)
-                  return value
-                }
-              }
+			var options = $wnd.SRC.xssOptions;
 			$wnd.xss = new $wnd.filterXSS.FilterXSS(options)
 			return true
 		} catch (err) {

From f6850caedd2613ec217f28dcba3a172b96e75b18 Mon Sep 17 00:00:00 2001
From: Nick Grosenbacher <nickgrosenbacher@gmail.com>
Date: Wed, 11 Sep 2024 13:35:00 -0400
Subject: [PATCH 2/2] Update lockfile

---
 yarn.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index d0b921bcc9..94b51ece4e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4101,10 +4101,10 @@ markdown-it-synapse-math@^3.0.5:
   optionalDependencies:
     ascii2mathml "^0.6.2"
 
-markdown-it-synapse-table@^1.0.6:
-  version "1.0.6"
-  resolved "https://registry.yarnpkg.com/markdown-it-synapse-table/-/markdown-it-synapse-table-1.0.6.tgz#5e14383257a6f6495d6c097388911548fe2155fb"
-  integrity sha512-znhzQZhMxZ8sSQ9IBfdVv4ufW54i+P8M//rHEswcgg7SI3J0AN1s2T7T0KqYGG+9rHf/ORsdcUZst9hMiBC9xA==
+markdown-it-synapse-table@1.0.8, markdown-it-synapse-table@^1.0.8:
+  version "1.0.8"
+  resolved "https://registry.yarnpkg.com/markdown-it-synapse-table/-/markdown-it-synapse-table-1.0.8.tgz#38481a997fe6f1209f645061a5b230ed602317c4"
+  integrity sha512-Fhc7Mi2CUsuUXKjY3MNFhblXjqVhpIGJWsIGwB0hYSGrmiZrLlkAKHoIGwjnYLxEyawYrKIKaqkmjF9XCHrsqw==
 
 markdown-it-synapse@1.1.16, markdown-it-synapse@^1.1.16:
   version "1.1.16"
@@ -5924,10 +5924,10 @@ svg-path-sdf@^1.1.3:
     parse-svg-path "^0.1.2"
     svg-path-bounds "^1.0.1"
 
-synapse-react-client@3.3.11:
-  version "3.3.11"
-  resolved "https://registry.yarnpkg.com/synapse-react-client/-/synapse-react-client-3.3.11.tgz#00f5d536cb558bbeed2ae989679eb8e8edc43473"
-  integrity sha512-nZZWF6mwSqgTyHOlF6UfzWOi7BZjo2tGr6wY7vt4Urp9e6d9+1ArFtx8+BM+z2BNjfe6P/9VBr3eqXtb4ulhFA==
+synapse-react-client@3.3.12:
+  version "3.3.12"
+  resolved "https://registry.yarnpkg.com/synapse-react-client/-/synapse-react-client-3.3.12.tgz#7d2b4db2eaae6b9a4d3cb3438bf4475dfa7a5be2"
+  integrity sha512-LKDF8ok/HI4f0SbzN8ejkYjcIgLWGPvVNmC6OVX0B+CQYrva/fW1d4QPBUG69Jo8IiV93/X4wr3kUY6ixJL2eA==
   dependencies:
     "@apidevtools/json-schema-ref-parser" "^9.1.2"
     "@brainhubeu/react-carousel" "1.19.26"
@@ -5977,7 +5977,7 @@ synapse-react-client@3.3.11:
     markdown-it-synapse "1.1.16"
     markdown-it-synapse-heading "^1.0.1"
     markdown-it-synapse-math "^3.0.5"
-    markdown-it-synapse-table "^1.0.6"
+    markdown-it-synapse-table "1.0.8"
     mui-one-time-password-input "^2.0.2"
     papaparse "^5.4.1"
     plotly.js "2.28.0"