From 6b58d30eec8864de52844bfb8dac346ce5c729d7 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Wed, 9 Apr 2025 21:19:39 +0300
Subject: [PATCH] improve html sanitize

---
 client/src/view-helper.js | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/client/src/view-helper.js b/client/src/view-helper.js
index 12d931e763..9595cfcc86 100644
--- a/client/src/view-helper.js
+++ b/client/src/view-helper.js
@@ -77,6 +77,22 @@ class ViewHelper {
             if (node instanceof HTMLOListElement && node.start && node.start > 99) {
                 node.removeAttribute('start');
             }
+
+            if (node instanceof HTMLFormElement) {
+                if (node.action) {
+                    node.removeAttribute('action');
+                }
+
+                if (node.hasAttribute('method')) {
+                    node.removeAttribute('method');
+                }
+            }
+
+            if (node instanceof HTMLButtonElement) {
+                if (node.type === 'submit') {
+                    node.type = 'button';
+                }
+            }
         });
 
         DOMPurify.addHook('afterSanitizeAttributes', function (node) {
@@ -93,6 +109,29 @@ class ViewHelper {
                 }
             }
         });
+
+        DOMPurify.addHook('uponSanitizeAttribute', (node, data) => {
+            if (data.attrName === 'style') {
+                const style = data.attrValue
+                    .split(';')
+                    .map(s => s.trim())
+                    .filter(rule => {
+                        const [property, value] = rule.split(':')
+                            .map(s => s.trim().toLowerCase());
+
+                        if (
+                            property === 'position' &&
+                            ['absolute', 'fixed', 'sticky'].includes(value)
+                        ) {
+                            return false;
+                        }
+
+                        return true;
+                    });
+
+                data.attrValue = style.join('; ');
+            }
+        });
     }
 
     /**