({ html, className = '' })
| 7 | } |
| 8 | |
| 9 | export const SafeHtml: React.FC<SafeHtmlProps> = ({ html, className = '' }) => { |
| 10 | const sanitizeConfig = { |
| 11 | ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a', 'img', 'div', 'span'], |
| 12 | ALLOWED_ATTR: ['href', 'target', 'src', 'alt', 'class', 'style'], |
| 13 | ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i, |
| 14 | ALLOW_DATA_ATTR: false, |
| 15 | }; |
| 16 | |
| 17 | const sanitizedHtml = DOMPurify.sanitize(html, sanitizeConfig); |
| 18 | |
| 19 | return ( |
| 20 | <div |
| 21 | className={`safe-html ${className} text-sm`} |
| 22 | dangerouslySetInnerHTML={{ __html: sanitizedHtml }} |
| 23 | style={{ |
| 24 | wordBreak: 'break-word', |
| 25 | }} |
| 26 | /> |
| 27 | ); |
| 28 | }; |
nothing calls this directly
no outgoing calls
no test coverage detected