From e4d388ad333c477e54ed4d3a3ca512187f5d70ca Mon Sep 17 00:00:00 2001 From: Dimitri Mitropoulos Date: Thu, 10 Mar 2022 15:14:54 -0500 Subject: [PATCH] markdown generation now sanitizes with dompurify (#4579) --- .../app/common/markdown-to-html.ts | 4 +- packages/insomnia-app/package-lock.json | 41 ++++++++++--------- packages/insomnia-app/package.json | 5 ++- .../insomnia-send-request/package-lock.json | 14 +++---- packages/insomnia-send-request/package.json | 2 +- 5 files changed, 34 insertions(+), 32 deletions(-) diff --git a/packages/insomnia-app/app/common/markdown-to-html.ts b/packages/insomnia-app/app/common/markdown-to-html.ts index fbd2caf776..3c79af4744 100644 --- a/packages/insomnia-app/app/common/markdown-to-html.ts +++ b/packages/insomnia-app/app/common/markdown-to-html.ts @@ -1,3 +1,4 @@ +import { sanitize } from 'dompurify'; import { marked } from 'marked'; marked.setOptions({ @@ -5,9 +6,8 @@ marked.setOptions({ gfm: true, breaks: false, pedantic: false, - sanitize: true, smartLists: true, smartypants: false, }); -export const markdownToHTML = marked.parse; +export const markdownToHTML = (input: string) => sanitize(marked.parse(input)); diff --git a/packages/insomnia-app/package-lock.json b/packages/insomnia-app/package-lock.json index 3f8e154155..ea1af77a02 100644 --- a/packages/insomnia-app/package-lock.json +++ b/packages/insomnia-app/package-lock.json @@ -21,6 +21,7 @@ "codemirror": "^5.62.3", "codemirror-graphql": "^1.0.2", "color": "^3.1.2", + "dompurify": "^2.3.6", "electron-context-menu": "^3.1.1", "electron-log": "^4.4.3", "framer-motion": "^1.11.1", @@ -39,7 +40,7 @@ "jsonlint-mod-fixed": "1.7.7", "jsonpath-plus": "^6.0.1", "jwt-authentication": "^0.4.0", - "marked": "^4.0.10", + "marked": "^4.0.12", "mime-types": "^2.1.18", "mkdirp": "^0.5.1", "moment": "^2.21.0", @@ -106,7 +107,7 @@ "@types/js-yaml": "^4.0.1", "@types/less": "^3.0.2", "@types/license-checker": "^25.0.1", - "@types/marked": "^4.0.1", + "@types/marked": "^4.0.2", "@types/mime-types": "^2.1.0", "@types/mkdirp": "^0.5.2", "@types/multiparty": "^0.0.32", @@ -7477,9 +7478,9 @@ "dev": true }, "node_modules/@types/marked": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@types/marked/-/marked-4.0.1.tgz", - "integrity": "sha512-ZigEmCWdNUU7IjZEuQ/iaimYdDHWHfTe3kg8ORfKjyGYd9RWumPoOJRQXB0bO+XLkNwzCthW3wUIQtANaEZ1ag==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/@types/marked/-/marked-4.0.2.tgz", + "integrity": "sha512-auNrZ/c0w6wsM9DccwVxWHssrMDezHUAXNesdp2RQrCVCyrQbOiSq7yqdJKrUQQpw9VTm7CGYJH2A/YG7jjrjQ==", "dev": true }, "node_modules/@types/mime": { @@ -13386,9 +13387,9 @@ } }, "node_modules/dompurify": { - "version": "2.0.12", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.0.12.tgz", - "integrity": "sha512-Fl8KseK1imyhErHypFPA8qpq9gPzlsJ/EukA6yk9o0gX23p1TzC+rh9LqNg1qvErRTc0UNMYlKxEGSfSh43NDg==" + "version": "2.3.6", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.6.tgz", + "integrity": "sha512-OFP2u/3T1R5CEgWCEONuJ1a5+MFKnOYpkywpUSxv/dj1LeBT1erK+JwM7zK0ROy2BRhqVCf0LRw/kHqKuMkVGg==" }, "node_modules/domutils": { "version": "1.5.1", @@ -21618,9 +21619,9 @@ "integrity": "sha512-MyoZ0jgnLvB2X3Lg5HqpFmn1kybDiIfEQmKzTb5apr51Rb+T3KdmMiqa70T+bhGnyv7bQ6WMj2QMHpGMmlrUYQ==" }, "node_modules/marked": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.10.tgz", - "integrity": "sha512-+QvuFj0nGgO970fySghXGmuw+Fd0gD2x3+MqCWLIPf5oxdv1Ka6b2q+z9RP01P/IaKPMEramy+7cNy/Lw8c3hw==", + "version": "4.0.12", + "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.12.tgz", + "integrity": "sha512-hgibXWrEDNBWgGiK18j/4lkS6ihTe9sxtV4Q1OQppb/0zzyPSzoFANBa5MfsG/zgsWklmNnhm0XACZOH/0HBiQ==", "bin": { "marked": "bin/marked.js" }, @@ -37193,9 +37194,9 @@ "dev": true }, "@types/marked": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@types/marked/-/marked-4.0.1.tgz", - "integrity": "sha512-ZigEmCWdNUU7IjZEuQ/iaimYdDHWHfTe3kg8ORfKjyGYd9RWumPoOJRQXB0bO+XLkNwzCthW3wUIQtANaEZ1ag==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/@types/marked/-/marked-4.0.2.tgz", + "integrity": "sha512-auNrZ/c0w6wsM9DccwVxWHssrMDezHUAXNesdp2RQrCVCyrQbOiSq7yqdJKrUQQpw9VTm7CGYJH2A/YG7jjrjQ==", "dev": true }, "@types/mime": { @@ -42059,9 +42060,9 @@ } }, "dompurify": { - "version": "2.0.12", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.0.12.tgz", - "integrity": "sha512-Fl8KseK1imyhErHypFPA8qpq9gPzlsJ/EukA6yk9o0gX23p1TzC+rh9LqNg1qvErRTc0UNMYlKxEGSfSh43NDg==" + "version": "2.3.6", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.6.tgz", + "integrity": "sha512-OFP2u/3T1R5CEgWCEONuJ1a5+MFKnOYpkywpUSxv/dj1LeBT1erK+JwM7zK0ROy2BRhqVCf0LRw/kHqKuMkVGg==" }, "domutils": { "version": "1.5.1", @@ -48590,9 +48591,9 @@ "requires": {} }, "marked": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.10.tgz", - "integrity": "sha512-+QvuFj0nGgO970fySghXGmuw+Fd0gD2x3+MqCWLIPf5oxdv1Ka6b2q+z9RP01P/IaKPMEramy+7cNy/Lw8c3hw==" + "version": "4.0.12", + "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.12.tgz", + "integrity": "sha512-hgibXWrEDNBWgGiK18j/4lkS6ihTe9sxtV4Q1OQppb/0zzyPSzoFANBa5MfsG/zgsWklmNnhm0XACZOH/0HBiQ==" }, "matcher": { "version": "3.0.0", diff --git a/packages/insomnia-app/package.json b/packages/insomnia-app/package.json index c31c065adf..29a90174a8 100644 --- a/packages/insomnia-app/package.json +++ b/packages/insomnia-app/package.json @@ -89,6 +89,7 @@ "codemirror": "^5.62.3", "codemirror-graphql": "^1.0.2", "color": "^3.1.2", + "dompurify": "^2.3.6", "electron-context-menu": "^3.1.1", "electron-log": "^4.4.3", "framer-motion": "^1.11.1", @@ -131,7 +132,7 @@ "jsonlint-mod-fixed": "1.7.7", "jsonpath-plus": "^6.0.1", "jwt-authentication": "^0.4.0", - "marked": "^4.0.10", + "marked": "^4.0.12", "mime-types": "^2.1.18", "mkdirp": "^0.5.1", "moment": "^2.21.0", @@ -199,7 +200,7 @@ "@types/js-yaml": "^4.0.1", "@types/less": "^3.0.2", "@types/license-checker": "^25.0.1", - "@types/marked": "^4.0.1", + "@types/marked": "^4.0.2", "@types/mime-types": "^2.1.0", "@types/mkdirp": "^0.5.2", "@types/multiparty": "^0.0.32", diff --git a/packages/insomnia-send-request/package-lock.json b/packages/insomnia-send-request/package-lock.json index 533e294ff3..f91dfa2eb7 100644 --- a/packages/insomnia-send-request/package-lock.json +++ b/packages/insomnia-send-request/package-lock.json @@ -26,7 +26,7 @@ "jshint": "^2.11.1", "jsonlint-mod-fixed": "1.7.7", "jsonpath-plus": "^6.0.1", - "marked": "^4.0.10", + "marked": "^4.0.12", "mime-types": "^2.1.27", "mkdirp": "^1.0.4", "multiparty": "^4.2.1", @@ -2362,9 +2362,9 @@ "integrity": "sha1-5WqpTEyAVaFkBKBnS3jyFffI4ZQ=" }, "node_modules/marked": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.10.tgz", - "integrity": "sha512-+QvuFj0nGgO970fySghXGmuw+Fd0gD2x3+MqCWLIPf5oxdv1Ka6b2q+z9RP01P/IaKPMEramy+7cNy/Lw8c3hw==", + "version": "4.0.12", + "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.12.tgz", + "integrity": "sha512-hgibXWrEDNBWgGiK18j/4lkS6ihTe9sxtV4Q1OQppb/0zzyPSzoFANBa5MfsG/zgsWklmNnhm0XACZOH/0HBiQ==", "bin": { "marked": "bin/marked.js" }, @@ -5663,9 +5663,9 @@ "integrity": "sha1-5WqpTEyAVaFkBKBnS3jyFffI4ZQ=" }, "marked": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.10.tgz", - "integrity": "sha512-+QvuFj0nGgO970fySghXGmuw+Fd0gD2x3+MqCWLIPf5oxdv1Ka6b2q+z9RP01P/IaKPMEramy+7cNy/Lw8c3hw==" + "version": "4.0.12", + "resolved": "https://registry.npmjs.org/marked/-/marked-4.0.12.tgz", + "integrity": "sha512-hgibXWrEDNBWgGiK18j/4lkS6ihTe9sxtV4Q1OQppb/0zzyPSzoFANBa5MfsG/zgsWklmNnhm0XACZOH/0HBiQ==" }, "md5": { "version": "2.3.0", diff --git a/packages/insomnia-send-request/package.json b/packages/insomnia-send-request/package.json index 30604f61d5..f0c2632163 100644 --- a/packages/insomnia-send-request/package.json +++ b/packages/insomnia-send-request/package.json @@ -28,7 +28,7 @@ "jshint": "^2.11.1", "jsonlint-mod-fixed": "1.7.7", "jsonpath-plus": "^6.0.1", - "marked": "^4.0.10", + "marked": "^4.0.12", "mime-types": "^2.1.27", "mkdirp": "^1.0.4", "multiparty": "^4.2.1",