add text sanitization to the md element #55

ucd-library · Apr 29, 2022 · cdb7835 · cdb7835
1 parent 935c745
commit cdb7835
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/elements/package.json b/elements/package.json
@@ -11,6 +11,7 @@
   "dependencies": {
     "@lit-labs/task": "^1.0.0",
     "@ucd-lib/theme-sass": "^5.0.15",
+    "dompurify": "^2.3.6",
     "ip-cidr": "^3.0.4",
     "lit": "^2.0.2",
     "marked": "^4.0.14",

diff --git a/elements/ucdlib/ucdlib-md/ucdlib-md.js b/elements/ucdlib/ucdlib-md/ucdlib-md.js
@@ -1,5 +1,6 @@
 import { LitElement, css } from 'lit';
 import { marked } from 'marked';
+import DOMPurify from 'dompurify';
 import { UcdlibMdContent } from './ucdlib-md-content.js';
 import { MutationObserverController } from '../../utils/controllers/mutation-observer.js';
 
@@ -75,7 +76,7 @@ export default class UcdlibMd extends LitElement {
     this._setRendererOverrides();
 
     // update markdown data with the latest, either when the content changes or data property is updated
-    this.data = marked.parse(this.data);
+    this.data = DOMPurify.sanitize(marked.parse(this.data));
     this.renderedElement.innerHTML = this.data;
   }