Instance homepage support (#4007)

[github/Chocobozzz/PeerTube.git] / shared / core-utils / renderer / html.ts

diff --git a/shared/core-utils/renderer/html.ts b/shared/core-utils/renderer/html.ts
index 1220848a0a2cc4fcbb45ebebd8d9fb37f25ab9fd..bbf8b3fbd6531cc8222f6dcea821e66c57b76443 100644 (file)
--- a/shared/core-utils/renderer/html.ts
+++ b/shared/core-utils/renderer/html.ts
@@ -1,21 +1,59 @@
-export const SANITIZE_OPTIONS = {
-  allowedTags: [ 'a', 'p', 'span', 'br', 'strong', 'em', 'ul', 'ol', 'li' ],
-  allowedSchemes: [ 'http', 'https' ],
-  allowedAttributes: {
-    a: [ 'href', 'class', 'target', 'rel' ]
-  },
-  transformTags: {
-    a: (tagName: string, attribs: any) => {
-      let rel = 'noopener noreferrer'
-      if (attribs.rel === 'me') rel += ' me'
+export function getSanitizeOptions () {
+  return {
+    allowedTags: [ 'a', 'p', 'span', 'br', 'strong', 'em', 'ul', 'ol', 'li' ],
+    allowedSchemes: [ 'http', 'https' ],
+    allowedAttributes: {
+      'a': [ 'href', 'class', 'target', 'rel' ],
+      '*': [ 'data-*' ]
+    },
+    transformTags: {
+      a: (tagName: string, attribs: any) => {
+        let rel = 'noopener noreferrer'
+        if (attribs.rel === 'me') rel += ' me'
 
-      return {
-        tagName,
-        attribs: Object.assign(attribs, {
-          target: '_blank',
-          rel
-        })
+        return {
+          tagName,
+          attribs: Object.assign(attribs, {
+            target: '_blank',
+            rel
+          })
+        }
       }
     }
   }
 }
+
+export function getCustomMarkupSanitizeOptions (additionalAllowedTags: string[] = []) {
+  const base = getSanitizeOptions()
+
+  return {
+    allowedTags: [
+      ...base.allowedTags,
+      ...additionalAllowedTags,
+      'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6'
+    ],
+    allowedSchemes: base.allowedSchemes,
+    allowedAttributes: {
+      ...base.allowedAttributes,
+      '*': [ 'data-*', 'style' ]
+    }
+  }
+}
+
+// Thanks: https://stackoverflow.com/a/12034334
+export function escapeHTML (stringParam: string) {
+  if (!stringParam) return ''
+
+  const entityMap = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    '\'': '&#39;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+  }
+
+  return String(stringParam).replace(/[&<>"'`=/]/g, s => entityMap[s])
+}