Function sanitizeElement

core/src/utils/sanitization/index.ts:97–154

(element: any)

 */
// TODO(FW-2832): type (using Element triggers other type errors as well)
const sanitizeElement = (element: any) => {
  // IE uses childNodes, so ignore nodes that are not elements
  if (element.nodeType && element.nodeType !== 1) {
    return;
  }

  /**
   * If attributes is not a NamedNodeMap
   * then we should remove the element entirely.
   * This helps avoid DOM Clobbering attacks where
   * attributes is overridden.
   */
  if (typeof NamedNodeMap !== 'undefined' && !(element.attributes instanceof NamedNodeMap)) {
    element.remove();
    return;
  }

  for (let i = element.attributes.length - 1; i >= 0; i--) {
    const attribute = element.attributes.item(i);
    const attributeName = attribute.name;

    // remove non-allowed attribs
    if (!allowedAttributes.includes(attributeName.toLowerCase())) {
      element.removeAttribute(attributeName);
      continue;
    }

    // clean up any allowed attribs
    // that attempt to do any JS funny-business
    const attributeValue = attribute.value;

    /**
     * We also need to check the property value
     * as javascript: can allow special characters
     * such as 	 and still be valid (i.e. java	script)
     */
    const propertyValue = element[attributeName];

    /* eslint-disable */
    if (
      (attributeValue != null && attributeValue.toLowerCase().includes('javascript:')) ||
      (propertyValue != null && propertyValue.toLowerCase().includes('javascript:'))
    ) {
      element.removeAttribute(attributeName);
    }
    /* eslint-enable */
  }

  /**
   * Sanitize any nested children
   */
  const childElements = getElementChildren(element);

  /* eslint-disable-next-line */
  for (let i = 0; i < childElements.length; i++) {
    sanitizeElement(childElements[i]);
  }
};