diff --git a/apps/server/src/modules/news/controller/dto/create-news.params.ts b/apps/server/src/modules/news/controller/dto/create-news.params.ts index 6bc1d3049e5..e54ab40be2b 100644 --- a/apps/server/src/modules/news/controller/dto/create-news.params.ts +++ b/apps/server/src/modules/news/controller/dto/create-news.params.ts @@ -15,8 +15,7 @@ export class CreateNewsParams { title!: string; @IsString() - // TODO add correct validation for input format - @SanitizeHtml(InputFormat.RICH_TEXT) + @SanitizeHtml(InputFormat.RICH_TEXT_CK5_SIMPLE) @ApiProperty({ description: 'Content of the News entity', }) diff --git a/apps/server/src/modules/news/controller/dto/update-news.params.ts b/apps/server/src/modules/news/controller/dto/update-news.params.ts index f91b26eb46d..9489702524a 100644 --- a/apps/server/src/modules/news/controller/dto/update-news.params.ts +++ b/apps/server/src/modules/news/controller/dto/update-news.params.ts @@ -18,7 +18,7 @@ export class UpdateNewsParams { @IsOptional() @IsString() - @SanitizeHtml(InputFormat.RICH_TEXT) + @SanitizeHtml(InputFormat.RICH_TEXT_CK5_SIMPLE) @ApiPropertyOptional({ description: 'Content of the News entity', }) diff --git a/apps/server/src/shared/controller/transformer/sanitize-html.transformer.spec.ts b/apps/server/src/shared/controller/transformer/sanitize-html.transformer.spec.ts index 75502ded02b..da850a7d78e 100644 --- a/apps/server/src/shared/controller/transformer/sanitize-html.transformer.spec.ts +++ b/apps/server/src/shared/controller/transformer/sanitize-html.transformer.spec.ts @@ -12,20 +12,17 @@ describe('SanitizeHtmlTransformer Decorator', () => { @SanitizeHtml(InputFormat.PLAIN_TEXT) title2!: string; - @SanitizeHtml(InputFormat.RICH_TEXT_SIMPLE) + @SanitizeHtml(InputFormat.PLAIN_TEXT) excerpt?: string; - @SanitizeHtml(InputFormat.RICH_TEXT) - content!: string; - @SanitizeHtml(InputFormat.RICH_TEXT_CK5) contentCk5!: string; - @SanitizeHtml(InputFormat.RICH_TEXT_CK5_SIMPLE) - contentCk5Simple!: string; - @SanitizeHtml(InputFormat.RICH_TEXT_CK4) contentCk4!: string; + + @SanitizeHtml(InputFormat.RICH_TEXT_CK5_SIMPLE) + contentRichTextCk5Simple!: string; } describe('when fully sanitizing an input string', () => { @@ -40,22 +37,6 @@ describe('SanitizeHtmlTransformer Decorator', () => { }); }); - describe('when sanitizing inline formatting', () => { - it('should remove all html but inline tags', () => { - const plainString = { excerpt: '

html text

' }; - const instance = plainToClass(WithHtmlDto, plainString); - expect(instance.excerpt).toEqual('html text'); - }); - }); - - describe('when sanitizing rich text formatting', () => { - it('should remove all html but rich text tags', () => { - const plainString = { content: '

html text

' }; - const instance = plainToClass(WithHtmlDto, plainString); - expect(instance.content).toEqual('

html text

'); - }); - }); - describe('when sanitizing rich text ck5 formatting', () => { it('should remove all html but rich text ck5 tags', () => { const plainString = { @@ -69,22 +50,26 @@ describe('SanitizeHtmlTransformer Decorator', () => { }); }); - describe('when sanitizing rich text ck5 simple formatting', () => { - it('should remove all html but rich text ck5 simple tags', () => { + describe('when sanitizing rich text ck4 formatting', () => { + it('should remove all html but rich text ck4 tags', () => { const plainString = { - contentCk5Simple: - '

strong
text

', + contentCk4: '

html text

', }; const instance = plainToClass(WithHtmlDto, plainString); - expect(instance.contentCk5Simple).toEqual('

strong
text

'); + expect(instance.contentCk4).toEqual('

html text

'); }); }); - describe('when sanitizing rich text ck4 formatting', () => { - it('should remove all html but rich text ck4 tags', () => { - const plainString = { contentCk4: '

html text

' }; + describe('when sanitizing rich text Ck5 simple formatting', () => { + it('should remove all html but rich text ck5 simple tags', () => { + const plainString = { + contentRichTextCk5Simple: + '

html

text

[x=\frac{-bpmsqrt{b^2-4ac}}{2a}]', + }; const instance = plainToClass(WithHtmlDto, plainString); - expect(instance.contentCk4).toEqual('

html text

'); + expect(instance.contentRichTextCk5Simple).toEqual( + '

html

text

[x= rac{-bpmsqrt{b^2-4ac}}{2a}]' + ); }); }); diff --git a/apps/server/src/shared/controller/transformer/sanitize-html.transformer.ts b/apps/server/src/shared/controller/transformer/sanitize-html.transformer.ts index 31c137b32b4..d455422c93a 100644 --- a/apps/server/src/shared/controller/transformer/sanitize-html.transformer.ts +++ b/apps/server/src/shared/controller/transformer/sanitize-html.transformer.ts @@ -14,55 +14,6 @@ const inputFormatsSanitizeConfig: Record = { allowedAttributes: {}, }, - RichTextSimple: { - allowedTags: ['b', 'i', 'em', 'strong', 'small', 's', 'u'], - allowedAttributes: {}, - }, - - RichText: { - allowedTags: [ - 'b', - 'i', - 'em', - 'strong', - 'small', - 's', - 'u', - 'h1', - 'h2', - 'h3', - 'h4', - 'h5', - 'h6', - 'ul', - 'li', - 'ol', - 'dl', - 'dt', - 'dd', - 'p', - 'pre', - 'br', - 'hr', - 'table', - 'tbody', - 'td', - 'tfoot', - 'th', - 'thead', - 'tr', - 'tr', - 'td', - 'a', - 'img', - ], - allowedAttributes: { - a: ['href', 'name', 'target'], - img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'loading'], - }, - }, - - // TODO RichTextCk4: { allowedTags: [ 'b', @@ -146,23 +97,21 @@ const inputFormatsSanitizeConfig: Record = { }, RichTextCk5Simple: { - allowedTags: ['p', 'br', 'b', 'strong', 'i', 'em', 'u'], - allowedAttributes: {}, + allowedTags: ['p', 'br', 'strong', 'em', 'u', 's', 'h2', 'h3', 'h4', 'ul', 'ol', 'li', 'img', 'src'], + allowedAttributes: { + img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'loading'], + }, }, }; export const getSanitizeHtmlOptions = (inputFormat?: InputFormat): IInputFormatsConfig => { switch (inputFormat) { - case InputFormat.RICH_TEXT_SIMPLE: - return inputFormatsSanitizeConfig.RichTextSimple; - case InputFormat.RICH_TEXT: - return inputFormatsSanitizeConfig.RichText; + case InputFormat.RICH_TEXT_CK5_SIMPLE: + return inputFormatsSanitizeConfig.RichTextCk5Simple; case InputFormat.RICH_TEXT_CK4: return inputFormatsSanitizeConfig.RichTextCk4; case InputFormat.RICH_TEXT_CK5: return inputFormatsSanitizeConfig.RichTextCk5; - case InputFormat.RICH_TEXT_CK5_SIMPLE: - return inputFormatsSanitizeConfig.RichTextCk5Simple; case InputFormat.PLAIN_TEXT: default: return inputFormatsSanitizeConfig.PlainText; diff --git a/apps/server/src/shared/domain/types/input-format.types.ts b/apps/server/src/shared/domain/types/input-format.types.ts index 54ed008d218..b43278557b5 100644 --- a/apps/server/src/shared/domain/types/input-format.types.ts +++ b/apps/server/src/shared/domain/types/input-format.types.ts @@ -1,8 +1,6 @@ export enum InputFormat { PLAIN_TEXT = 'plainText', - RICH_TEXT = 'richText', - RICH_TEXT_SIMPLE = 'inline', + RICH_TEXT_CK5_SIMPLE = 'richTextCk5Simple', RICH_TEXT_CK4 = 'richTextCk4', RICH_TEXT_CK5 = 'richTextCk5', - RICH_TEXT_CK5_SIMPLE = 'richTextCk5Inline', }