bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(docs): sanitize markdown HTML output to prevent XSS (fixes #63)

Browse source
This commit is contained in:
FuturMix 2026-06-14 12:20:10 +08:00
parent 8f4691584c
commit 0e93bf92b5
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apps/logicsrc-web/src/app/docs/[slug]/page.tsx
View file

@ -3,6 +3,7 @@ import { notFound } from "next/navigation";
import type { ReactNode } from "react"; import type { ReactNode } from "react";
import type { Metadata } from "next"; import type { Metadata } from "next";
import { marked } from "marked"; import { marked } from "marked";
import sanitizeHtml from "sanitize-html";
import { DOC_SLUGS, docExcerpt, docTitle, readDoc } from "@/lib/docs"; import { DOC_SLUGS, docExcerpt, docTitle, readDoc } from "@/lib/docs";
import { SiteShell } from "@/components/site-shell"; import { SiteShell } from "@/components/site-shell";
@ -37,7 +38,16 @@ export default async function DocPage({
const md = readDoc(slug); const md = readDoc(slug);
if (!md) notFound(); if (!md) notFound();
const html = await marked.parse(md); const rawHtml = await marked.parse(md);
const html = sanitizeHtml(rawHtml, {
allowedTags: sanitizeHtml.defaults.allowedTags.concat(["img", "h1", "h2", "h3"]),
allowedAttributes: {
...sanitizeHtml.defaults.allowedAttributes,
img: ["src", "alt", "width", "height"],
a: ["href", "name", "target", "rel"],
code: ["class"],
},
});
return ( return (
<SiteShell active="Docs"> <SiteShell active="Docs">