Skip to content

Commit

Permalink
Fix error when trying to call addHook() in unsupported environments
Browse files Browse the repository at this point in the history
  • Loading branch information
GarboMuffin committed Dec 30, 2023
1 parent 40bbd34 commit 62fe825
Showing 1 changed file with 38 additions and 35 deletions.
73 changes: 38 additions & 35 deletions src/sanitize-svg.js
Original file line number Diff line number Diff line change
Expand Up @@ -8,48 +8,51 @@ const DOMPurify = require('dompurify');

const sanitizeSvg = {};

DOMPurify.addHook(
'beforeSanitizeAttributes',
currentNode => {

if (currentNode && currentNode.href && currentNode.href.baseVal) {
const href = currentNode.href.baseVal.replace(/\s/g, '');
// "data:" and "#" are valid hrefs
if ((href.slice(0, 5) !== 'data:') && (href.slice(0, 1) !== '#')) {

if (currentNode.attributes.getNamedItem('xlink:href')) {
currentNode.attributes.removeNamedItem('xlink:href');
delete currentNode['xlink:href'];
}
if (currentNode.attributes.getNamedItem('href')) {
currentNode.attributes.removeNamedItem('href');
delete currentNode.href;
// addHook() is undefined when running in an unsupported environment (eg. Node)
if (DOMPurify.isSupported) {
DOMPurify.addHook(
'beforeSanitizeAttributes',
currentNode => {

if (currentNode && currentNode.href && currentNode.href.baseVal) {
const href = currentNode.href.baseVal.replace(/\s/g, '');
// "data:" and "#" are valid hrefs
if ((href.slice(0, 5) !== 'data:') && (href.slice(0, 1) !== '#')) {

if (currentNode.attributes.getNamedItem('xlink:href')) {
currentNode.attributes.removeNamedItem('xlink:href');
delete currentNode['xlink:href'];
}
if (currentNode.attributes.getNamedItem('href')) {
currentNode.attributes.removeNamedItem('href');
delete currentNode.href;
}
}
}
return currentNode;
}
return currentNode;
}
);
);

DOMPurify.addHook(
'uponSanitizeElement',
(node, data) => {
if (data.tagName === 'style') {
const ast = parse(node.textContent);
let isModified = false;
// Remove any @import rules as it could leak HTTP requests
walk(ast, (astNode, item, list) => {
if (astNode.type === 'Atrule' && astNode.name === 'import') {
list.remove(item);
isModified = true;
DOMPurify.addHook(
'uponSanitizeElement',
(node, data) => {
if (data.tagName === 'style') {
const ast = parse(node.textContent);
let isModified = false;
// Remove any @import rules as it could leak HTTP requests
walk(ast, (astNode, item, list) => {
if (astNode.type === 'Atrule' && astNode.name === 'import') {
list.remove(item);
isModified = true;
}
});
if (isModified) {
node.textContent = generate(ast);
}
});
if (isModified) {
node.textContent = generate(ast);
}
}
}
);
);
}

// Use JS implemented TextDecoder and TextEncoder if it is not provided by the
// browser.
Expand Down

0 comments on commit 62fe825

Please sign in to comment.