feat: certification rules, content sanitization, handle draft course updates and reset content, better redis logging

packages/utils/src/functions/index.ts

@@ -1,3 +1,4 @@
 export * from './array';
 export * from './fileValidation';
+export * from './sanitize';
 export * from './slug';

packages/utils/src/functions/sanitize.ts

@@ -0,0 +1,50 @@
+export const FORBID_TAGS = [
+  'script',
+  'iframe',
+  'object',
+  'embed',
+  'form',
+  'input',
+  'textarea',
+  'select',
+  'button',
+  'meta',
+  'link',
+  'svg',
+  'math'
+] as const;
+
+export const FORBID_ATTR = [
+  'onerror',
+  'onload',
+  'onclick',
+  'onmouseover',
+  'onfocus',
+  'onblur',
+  'onchange',
+  'onsubmit',
+  'onreset',
+  'onselect',
+  'onunload'
+] as const;
+
+export const ADD_ATTR = ['data-type', 'data-latex', 'colwidth'] as const;
+
+export const ALLOWED_URI_REGEXP =
+  /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
+
+export function createSanitizeHtmlConfig() {
+  return {
+    FORBID_TAGS: [...FORBID_TAGS],
+    FORBID_ATTR: [...FORBID_ATTR],
+    ADD_ATTR: [...ADD_ATTR],
+    KEEP_CONTENT: true,
+    SANITIZE_DOM: true,
+    ALLOW_DATA_ATTR: false,
+    ALLOWED_URI_REGEXP
+  };
+}
+
+export function stripSvgDataUrls(html: string): string {
+  return html.replace(/src\s*=\s*["']data:image\/svg[^"']*["']/gi, 'src=""');
+}