fix: Sanitise markdown

filamentphp · Jul 3, 2022 · 2d2c95a · 2d2c95a
1 parent e9d9beb
commit 2d2c95a
Show file tree

Hide file tree

Showing 16 changed files with 2,998 additions and 408 deletions.
diff --git a/composer.json b/composer.json
@@ -4,7 +4,8 @@
     "license": "MIT",
     "require": {
         "php": "^8.0",
-        "ext-intl": "*"
+        "ext-intl": "*",
+        "tgalopin/html-sanitizer": "^1.5"
     },
     "require-dev": {
         "akaunting/laravel-money": "^1.2|^2.0|^3.0",

diff --git a/composer.lock b/composer.lock
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -20,6 +20,7 @@
         "chart.js": "^3.6.0",
         "choices.js": "^10.1.0",
         "dayjs": "^1.10.6",
+        "dompurify": "^2.3.8",
         "esbuild": "^0.8.57",
         "filepond": "^4.28.2",
         "filepond-plugin-file-validate-size": "^2.2.4",

diff --git a/packages/admin/dist/app.js b/packages/admin/dist/app.js
diff --git a/packages/admin/dist/app.js.map b/packages/admin/dist/app.js.map
diff --git a/packages/admin/dist/mix-manifest.json b/packages/admin/dist/mix-manifest.json
@@ -1,4 +1,4 @@
 {
-    "/app.js": "/app.js?id=06592a7c350e6a63d53f4c5fc5733942",
+    "/app.js": "/app.js?id=71fff667aa441611ca420996d1e1d041",
     "/app.css": "/app.css?id=5a1e9d40b70086578bd432130765b170"
 }
diff --git a/packages/admin/src/NotificationManager.php b/packages/admin/src/NotificationManager.php
@@ -16,7 +16,7 @@ public function notify(string $status, string $message): void
         session()->push('filament.notifications', [
             'id' => uniqid(),
             'status' => $status,
-            'message' => Str::markdown($message),
+            'message' => (string) Str::of($message)->markdown()->sanitizeHtml(),
         ]);
 
         $this->notifications = session()->get('filament.notifications');