diff --git a/packages/editor-ui/src/constants.ts b/packages/editor-ui/src/constants.ts index b03d5f3f82f64..501fbbcdebb6f 100644 --- a/packages/editor-ui/src/constants.ts +++ b/packages/editor-ui/src/constants.ts @@ -532,3 +532,19 @@ export const TEMPLATE_EXPERIMENT = { export const EXPERIMENTS_TO_TRACK = [TEMPLATE_EXPERIMENT.name, AUTO_INSERT_ACTION_EXPERIMENT.name]; export const NODE_TYPES_EXCLUDED_FROM_OUTPUT_NAME_APPEND = [FILTER_NODE_TYPE]; + +export const ALLOWED_HTML_ATTRIBUTES = ['href', 'name', 'target', 'title', 'class', 'id', 'style']; + +export const ALLOWED_HTML_TAGS = [ + 'p', + 'strong', + 'b', + 'code', + 'a', + 'br', + 'i', + 'em', + 'small', + 'details', + 'summary', +]; diff --git a/packages/editor-ui/src/utils/htmlUtils.ts b/packages/editor-ui/src/utils/htmlUtils.ts index 45ea9fcc1d780..4fb059697d9bd 100644 --- a/packages/editor-ui/src/utils/htmlUtils.ts +++ b/packages/editor-ui/src/utils/htmlUtils.ts @@ -1,13 +1,11 @@ import xss, { friendlyAttrValue } from 'xss'; +import { ALLOWED_HTML_ATTRIBUTES, ALLOWED_HTML_TAGS } from '@/constants'; /* Constants and utility functions that help in HTML, CSS and DOM manipulation */ export function sanitizeHtml(dirtyHtml: string) { - const allowedAttributes = ['href', 'name', 'target', 'title', 'class', 'id']; - const allowedTags = ['p', 'strong', 'b', 'code', 'a', 'br', 'i', 'em', 'small']; - const sanitizedHtml = xss(dirtyHtml, { onTagAttr: (tag, name, value) => { if (tag === 'img' && name === 'src') { @@ -19,8 +17,7 @@ export function sanitizeHtml(dirtyHtml: string) { } } - // Allow `allowedAttributes` and all `data-*` attributes - if (allowedAttributes.includes(name) || name.startsWith('data-')) { + if (ALLOWED_HTML_ATTRIBUTES.includes(name) || name.startsWith('data-')) { return `${name}="${friendlyAttrValue(value)}"`; } @@ -28,7 +25,7 @@ export function sanitizeHtml(dirtyHtml: string) { // Return nothing, means keep the default handling measure }, onTag: (tag) => { - if (!allowedTags.includes(tag)) return ''; + if (!ALLOWED_HTML_TAGS.includes(tag)) return ''; return; }, });