From 3376c3681f7880db3f374f1ad1603e6460375c8d Mon Sep 17 00:00:00 2001
From: zefie <zefie@zefie.net>
Date: Fri, 18 Mar 2022 16:54:52 -0400
Subject: [PATCH] update sanitizeSignature function - allow links to open
 services - allow some html tag attributes - probably need to add more
 whitelisted attributes - no scripting allowed

---
 zefie_wtvp_minisrv/WTVShared.js | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/zefie_wtvp_minisrv/WTVShared.js b/zefie_wtvp_minisrv/WTVShared.js
index 6cb31abc..3a1c9464 100644
--- a/zefie_wtvp_minisrv/WTVShared.js
+++ b/zefie_wtvp_minisrv/WTVShared.js
@@ -47,8 +47,31 @@ class WTVShared {
     }
 
     sanitizeSignature(string) {
+        var allowedSchemes = ['http', 'https', 'ftp', 'mailto'];
+        var self = this;
+        Object.keys(this.minisrv_config.services).forEach(function (k) {
+            var flags = self.minisrv_config.services[k].flags;
+            if (flags) {
+                if (flags == "0x00000004" || flags == "0x00000007") {
+                    allowedSchemes.push(self.minisrv_config.services[k].name);
+                }
+            }
+        });
+
         const clean = this.sanitizeHtml(string, {
-            allowedTags: ['a', 'audioscope', 'b', 'bgsound', 'big', 'blackface', 'blockquote', 'bq', 'br', 'caption', 'center', 'cite', 'c', 'dd', 'dfn', 'div', 'dl', 'dt', 'fn', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'html', 'i', 'img', 'label', 'li', 'link', 'listing', 'em', 'marquee', 'nobr', 'note', 'ol', 'p', 'plaintext', 'pre', 's', 'samp', 'small', 'span', 'strike', 'strong', 'style', 'sub', 'sup', 'tbody', 'table', 'td', 'th', 'tr', 'tt', 'u', 'ul'], allowedAttributes: false
+            allowedTags: ['a', 'audioscope', 'b', 'bgsound', 'big', 'blackface', 'blockquote', 'bq', 'br', 'caption', 'center', 'cite', 'c', 'dd', 'dfn', 'div', 'dl', 'dt', 'fn', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'html', 'i', 'img', 'label', 'li', 'link', 'listing', 'em', 'marquee', 'nobr', 'note', 'ol', 'p', 'plaintext', 'pre', 's', 'samp', 'small', 'span', 'strike', 'strong', 'style', 'sub', 'sup', 'tbody', 'table', 'td', 'th', 'tr', 'tt', 'u', 'ul'],
+            disallowedTagsMode: 'discard',
+            allowedAttributes: {
+                a: ['href', 'name', 'target'],
+                img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
+                bgsound: ['src', 'loop'],
+                font: ['size', 'name', 'color'],
+                marquee: ['speed'],
+            },
+            allowedSchemes: allowedSchemes,
+            allowedSchemesByTag: {},
+            allowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],
+            allowProtocolRelative: false
         })
         // todo: add missing user open tags (eg </i> if user did not close it) (might be done by sanitize-html?)
         // todo: figure out bgcolor and text color voodoo