From 440e24540f726de21a1f8906c159c23d4cf316ff Mon Sep 17 00:00:00 2001 From: Lars Date: Mon, 23 Dec 2024 11:19:06 +0100 Subject: [PATCH 1/3] fix(plugin-edusharing): use DomPurify to sanitize embed html from edu-sharing --- .../editor/src/plugins/edusharing-asset/renderer.tsx | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/packages/editor/src/plugins/edusharing-asset/renderer.tsx b/packages/editor/src/plugins/edusharing-asset/renderer.tsx index d5ee58120f..5d156c29d0 100644 --- a/packages/editor/src/plugins/edusharing-asset/renderer.tsx +++ b/packages/editor/src/plugins/edusharing-asset/renderer.tsx @@ -1,5 +1,6 @@ import EdusharingIcon from '@editor/editor-ui/assets/edusharing.svg' import { IframeResizer } from '@open-iframe-resizer/react' +import DOMPurify from 'dompurify' import * as t from 'io-ts' import { memo, useEffect, useState } from 'react' @@ -86,8 +87,15 @@ export function EdusharingAssetRenderer(props: { const html = buildHtml(htmlSnippet, defineContainerHeight) + const sanatizedHtml = DOMPurify.sanitize(html, { + // We allow