Dockery/Trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2026-05-07 07:26:36 +02:00
Code Issues Packages Projects Releases Activity

fix(server): safe import strips out bookmarks from note

Browse Source
This commit is contained in:
Elian Doran
2026-04-18 09:56:41 +03:00
parent cc010e1568
commit c0b1ff31e5
2 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
apps/server/src/services/html_sanitizer.spec.ts
View File

@@ -50,4 +50,26 @@ describe("sanitize", () => {
</figure>`;
expect(html_sanitizer.sanitize(dirty)).toBe(clean);
});
describe("bookmark anchors", () => {
it("preserves id attribute on empty <a> tags (CKEditor bookmarks)", () => {
const dirty = `<a id="my-bookmark"></a>`;
expect(html_sanitizer.sanitize(dirty)).toBe(dirty);
});
it("preserves id attribute on <a> tags with bookmark class", () => {
const dirty = `<a id="chapter-1" class="ck-bookmark"></a>`;
expect(html_sanitizer.sanitize(dirty)).toBe(dirty);
});
it("strips id attribute from non-anchor tags to prevent DOM clobbering", () => {
const dirty = `<div id="loginForm">content</div>`;
expect(html_sanitizer.sanitize(dirty)).toBe(`<div>content</div>`);
});
it("strips id attribute from <img> tags to prevent DOM clobbering", () => {
const dirty = `<img id="someId" src="test.png" />`;
expect(html_sanitizer.sanitize(dirty)).toBe(`<img src="test.png" />`);
});
});
});

1
apps/server/src/services/html_sanitizer.ts
View File

@@ -42,6 +42,7 @@ function sanitize(dirtyHtml: string) {
allowedTags: allowedTags as string[],
allowedAttributes: {
"*": ["class", "style", "title", "src", "href", "hash", "disabled", "align", "alt", "center", "data-*"],
a: ["id"], // CKEditor bookmark anchors use <a id="name"></a>
input: ["type", "checked"],
img: ["width", "height"],
code: [ "spellcheck" ]