diff --git a/client/src/view-helper.js b/client/src/view-helper.js index 12d931e763..9595cfcc86 100644 --- a/client/src/view-helper.js +++ b/client/src/view-helper.js @@ -77,6 +77,22 @@ class ViewHelper { if (node instanceof HTMLOListElement && node.start && node.start > 99) { node.removeAttribute('start'); } + + if (node instanceof HTMLFormElement) { + if (node.action) { + node.removeAttribute('action'); + } + + if (node.hasAttribute('method')) { + node.removeAttribute('method'); + } + } + + if (node instanceof HTMLButtonElement) { + if (node.type === 'submit') { + node.type = 'button'; + } + } }); DOMPurify.addHook('afterSanitizeAttributes', function (node) { @@ -93,6 +109,29 @@ class ViewHelper { } } }); + + DOMPurify.addHook('uponSanitizeAttribute', (node, data) => { + if (data.attrName === 'style') { + const style = data.attrValue + .split(';') + .map(s => s.trim()) + .filter(rule => { + const [property, value] = rule.split(':') + .map(s => s.trim().toLowerCase()); + + if ( + property === 'position' && + ['absolute', 'fixed', 'sticky'].includes(value) + ) { + return false; + } + + return true; + }); + + data.attrValue = style.join('; '); + } + }); } /**