Move away from marked sanitize, and use dompurify instead.

This commit is contained in:
Håvar Aambø Fosstveit
2019-11-07 08:56:26 +01:00
parent 43aa242b7b
commit 030ae8a24b
2 changed files with 7 additions and 3 deletions
@@ -2,6 +2,7 @@ import React from 'react';
import PropTypes from 'prop-types';
import classnames from 'classnames';
import { withStyles } from '@material-ui/core/styles';
import DOMPurify from 'dompurify';
import marked from 'marked';
import Paper from '@material-ui/core/Paper';
import Typography from '@material-ui/core/Typography';
@@ -76,9 +77,11 @@ const Message = (props) =>
className={classes.text}
variant='subtitle1'
// eslint-disable-next-line react/no-danger
dangerouslySetInnerHTML={{ __html : marked.parse(
text,
{ sanitize: true, renderer: linkRenderer }
dangerouslySetInnerHTML={{ __html : DOMPurify.sanitize(
marked.parse(
text,
{ renderer: linkRenderer }
)
) }}
/>
<Typography variant='caption'>{self ? 'Me' : name} - {time}</Typography>