xss protection

Clevis22 · Mar 3, 2024 · eacc59f · eacc59f
1 parent 2410554
commit eacc59f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/index.html b/index.html
@@ -58,5 +58,6 @@
     <script src="script.js"></script>
     <script src="shortcuts.js"></script>
     <script src="dependencies/highlight.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.9/purify.min.js" integrity="sha512-9+ilAOeXY8qy2bw/h51MmliNNHvdyhTpLIlqDmVpD26z8VjVJsUJtk5rhbDIUvYiD+EpGoAu0xTa7MhZohFQjA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   </body>
 </html>
diff --git a/script.js b/script.js
@@ -157,7 +157,9 @@ editor.addEventListener('input', () => {
 // get the message from the worker
 previewWorker.addEventListener('message', function(event) {
   var scrollTop = preview.scrollTop;
-  preview.innerHTML = event.data;
+  var cleanHTML = DOMPurify.sanitize(event.data); // Sanitize received HTML
+  preview.innerHTML = cleanHTML;
+  //preview.innerHTML = event.data;
   // Ensure scrolling happens after rendering
   requestAnimationFrame(function() {
     preview.scrollTop = scrollTop;