mirror of
https://github.com/navidrome/navidrome.git
synced 2026-08-01 07:21:17 +00:00
2731e25fd2
* fix(ui): use div for fragment, check lastfm url for artist page * use span instead of div for better compat * fix: implement isLastFmURL utility and add tests for URL validation --------- Co-authored-by: Deluan <deluan@navidrome.org>
28 lines
766 B
JavaScript
28 lines
766 B
JavaScript
import DOMPurify from 'dompurify'
|
|
import { useMemo } from 'react'
|
|
|
|
export const SafeHTML = ({ children }) => {
|
|
const purified = useMemo(() => {
|
|
const purify = DOMPurify()
|
|
|
|
purify.addHook('afterSanitizeElements', async (node) => {
|
|
if (node instanceof HTMLElement) {
|
|
// Set referrer-policy for elements with src
|
|
switch (node.tagName.toLowerCase()) {
|
|
case 'a':
|
|
case 'area':
|
|
case 'img':
|
|
case 'video':
|
|
case 'iframe':
|
|
case 'script':
|
|
node.setAttribute('referrer-policy', 'no-referrer')
|
|
}
|
|
}
|
|
})
|
|
|
|
return purify.sanitize(children, { ADD_ATTR: ['referrer-policy'] })
|
|
}, [children])
|
|
|
|
return <span dangerouslySetInnerHTML={{ __html: purified }} />
|
|
}
|