chore: Sanitize html content (#4498)

2022-04-21 11:27:28 +05:30
parent 2c73df4292
commit 27ddd77a1b
28 changed files with 52 additions and 29 deletions
@@ -80,8 +80,8 @@
    >
      <p
        v-if="isSignatureAvailable"
+        v-dompurify-html="formatMessage(messageSignature)"
        class="message-signature"
-        v-html="formatMessage(messageSignature)"
      />
      <p v-else class="message-signature">
        {{ $t('CONVERSATION.FOOTER.MESSAGE_SIGNATURE_NOT_CONFIGURED') }}
@@ -6,7 +6,7 @@
      'hide--quoted': !showQuotedContent,
    }"
  >
-    <div class="text-content" v-html="message"></div>
+    <div v-dompurify-html="message" class="text-content"></div>
    <button
      v-if="displayQuotedButton"
      class="quoted-text--button"
@@ -7,7 +7,7 @@
      <li>
        <span class="bullet">❌</span>
        <span
-          v-html="
+          v-dompurify-html="
            $t('MERGE_CONTACTS.SUMMARY.DELETE_WARNING', {
              childContactName,
            })
@@ -17,7 +17,7 @@
      <li>
        <span class="bullet">✅</span>
        <span
-          v-html="
+          v-dompurify-html="
            $t('MERGE_CONTACTS.SUMMARY.ATTRIBUTE_WARNING', {
              childContactName,
              primaryContactName,
@@ -35,7 +35,7 @@
        :reject-text="$t('DELETE_NOTE.CONFIRM.NO')"
      />
    </div>
-    <p class="note__content" v-html="formatMessage(note || '')" />
+    <p v-dompurify-html="formatMessage(note || '')" class="note__content" />
  </div>
 </template>

@@ -91,7 +91,7 @@
            button-class="large expanded"
          >
          </woot-submit-button>
-          <p class="accept--terms" v-html="termsLink"></p>
+          <p v-dompurify-html="termsLink" class="accept--terms"></p>
        </form>
        <div class="column text-center sigin--footer">
          <span>{{ $t('REGISTER.HAVE_AN_ACCOUNT') }}</span>
@@ -9,7 +9,9 @@
        {{ attribute }}
      </div>
      <div>
-        <span v-html="valueWithLink(customAttributes[attribute])"></span>
+        <span
+          v-dompurify-html="valueWithLink(customAttributes[attribute])"
+        ></span>
      </div>
    </div>
    <p v-if="!listOfAttributes.length">
@@ -14,7 +14,7 @@
        </div>
        <span class="timestamp">{{ readableTime }} </span>
      </div>
-      <p class="message-content" v-html="prepareContent(content)"></p>
+      <p v-dompurify-html="prepareContent(content)" class="message-content"></p>
    </div>
  </div>
 </template>
@@ -3,7 +3,7 @@
    <h2 class="page-sub-title">
      {{ headerTitle }}
    </h2>
-    <p class="small-12 column" v-html="headerContent"></p>
+    <p v-dompurify-html="headerContent" class="small-12 column"></p>
  </div>
 </template>

@@ -89,7 +89,7 @@
      </div>
      <div class="small-4 columns">
        <span
-          v-html="
+          v-dompurify-html="
            useInstallationName(
              $t('AGENT_MGMT.SIDEBAR_TXT'),
              globalConfig.installationName
@@ -76,7 +76,7 @@
      </div>
    </div>
    <div class="small-4 columns">
-      <span v-html="$t('ATTRIBUTES_MGMT.SIDEBAR_TXT')"></span>
+      <span v-dompurify-html="$t('ATTRIBUTES_MGMT.SIDEBAR_TXT')"></span>
    </div>
    <woot-modal :show.sync="showEditPopup" :on-close="hideEditPopup">
      <edit-attribute
@@ -81,7 +81,7 @@
      </div>

      <div class="small-4 columns">
-        <span v-html="$t('AUTOMATION.SIDEBAR_TXT')"></span>
+        <span v-dompurify-html="$t('AUTOMATION.SIDEBAR_TXT')"></span>
      </div>
    </div>
    <woot-modal
@@ -76,7 +76,7 @@
      </div>

      <div class="small-4 columns">
-        <span v-html="$t('CANNED_MGMT.SIDEBAR_TXT')"></span>
+        <span v-dompurify-html="$t('CANNED_MGMT.SIDEBAR_TXT')"></span>
      </div>
    </div>
    <!-- Add Agent -->
@@ -102,7 +102,7 @@

      <div class="small-4 columns">
        <span
-          v-html="
+          v-dompurify-html="
            useInstallationName(
              $t('INBOX_MGMT.SIDEBAR_TXT'),
              globalConfig.installationName
@@ -50,7 +50,7 @@
        <b>{{ integration.name }}</b>
      </p>
      <p
-        v-html="
+        v-dompurify-html="
          $t(
            `INTEGRATION_APPS.SIDEBAR_DESCRIPTION.${integration.name.toUpperCase()}`,
            { installationName: globalConfig.installationName }
@@ -4,7 +4,9 @@
      <div class="integration--description">
        <h5>{{ $t('INTEGRATION_SETTINGS.SLACK.HELP_TEXT.TITLE') }}</h5>
        <p>
-          <span v-html="$t('INTEGRATION_SETTINGS.SLACK.HELP_TEXT.BODY')"></span>
+          <span
+            v-dompurify-html="$t('INTEGRATION_SETTINGS.SLACK.HELP_TEXT.BODY')"
+          ></span>
        </p>
      </div>
    </div>
@@ -72,7 +72,7 @@

      <div class="small-4 columns">
        <span
-          v-html="
+          v-dompurify-html="
            useInstallationName(
              $t('INTEGRATION_SETTINGS.WEBHOOK.SIDEBAR_TXT'),
              globalConfig.installationName
@@ -72,7 +72,7 @@
      </div>

      <div class="small-4 columns">
-        <span v-html="$t('LABEL_MGMT.SIDEBAR_TXT')"></span>
+        <span v-dompurify-html="$t('LABEL_MGMT.SIDEBAR_TXT')"></span>
      </div>
    </div>
    <woot-modal :show.sync="showAddPopup" :on-close="hideAddPopup">
@@ -57,7 +57,7 @@

      <div class="small-4 columns">
        <span
-          v-html="
+          v-dompurify-html="
            $t('TEAMS_SETTINGS.SIDEBAR_TXT', {
              installationName: globalConfig.installationName,
            })