Add dompurify

Signed-off-by: Joshua Li <joshuali925@gmail.com>
opensearch-project · Dec 15, 2022 · 8fc4db5 · 8fc4db5
1 parent 8b32191
commit 8fc4db5
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 9 deletions.
diff --git a/dashboards-reports/package.json b/dashboards-reports/package.json
@@ -19,7 +19,7 @@
   "dependencies": {
     "babel-polyfill": "^6.26.0",
     "cron-validator": "^1.1.1",
-    "dompurify": "^2.3.8",
+    "dompurify": "^2.4.1",
     "elastic-builder": "^2.7.1",
     "enzyme-adapter-react-16": "^1.15.5",
     "html2canvas": "1.4.1",

diff --git a/dashboards-reports/public/components/visual_report/generate_report.ts b/dashboards-reports/public/components/visual_report/generate_report.ts
@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import createDOMPurify from 'dompurify';
 import html2canvas from 'html2canvas';
 import jsPDF from 'jspdf';
 import { v1 as uuidv1 } from 'uuid';
@@ -114,6 +115,7 @@ const computeHeight = (height: number, header: string, footer: string) => {
 
 export const generateReport = async (id: string, forceDelay = 15000) => {
   const http = uiSettingsService.getHttpClient();
+  const DOMPurify = createDOMPurify(window);
 
   const report = await http.get<ReportSchemaType>(
     '../api/reporting/reports/' + id
@@ -125,9 +127,11 @@ export const generateReport = async (id: string, forceDelay = 15000) => {
   const headerInput = report.report_definition.report_params.core_params.header;
   const footerInput = report.report_definition.report_params.core_params.footer;
   const header = headerInput
-    ? converter.makeHtml(headerInput)
+    ? DOMPurify.sanitize(converter.makeHtml(headerInput))
     : DEFAULT_REPORT_HEADER;
-  const footer = footerInput ? converter.makeHtml(footerInput) : '';
+  const footer = footerInput
+    ? DOMPurify.sanitize(converter.makeHtml(footerInput))
+    : '';
   const fileName =
     report.report_definition.report_params.report_name +
     `_${new Date().toISOString()}_${uuidv1()}.${format}`;

diff --git a/dashboards-reports/yarn.lock b/dashboards-reports/yarn.lock
@@ -2509,16 +2509,11 @@ domhandler@^3.0, domhandler@^3.0.0:
   dependencies:
     domelementtype "^2.0.1"
 
-dompurify@^2.2.0:
+dompurify@^2.2.0, dompurify@^2.4.1:
   version "2.4.1"
   resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-2.4.1.tgz#f9cb1a275fde9af6f2d0a2644ef648dd6847b631"
   integrity sha512-ewwFzHzrrneRjxzmK6oVz/rZn9VWspGFRDb4/rRtIsM1n36t9AKma/ye8syCpcw+XJ25kOK/hOG7t1j2I2yBqA==
 
-dompurify@^2.3.8:
-  version "2.3.8"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-2.3.8.tgz#224fe9ae57d7ebd9a1ae1ac18c1c1ca3f532226f"
-  integrity sha512-eVhaWoVibIzqdGYjwsBWodIQIaXFSB+cKDf4cfxLMsK0xiud6SE+/WCVx/Xw/UwQsa4cS3T2eITcdtmTg2UKcw==
-
 domutils@^2.0.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/domutils/-/domutils-2.2.0.tgz#f3ce1610af5c30280bde1b71f84b018b958f32cf"