diff --git a/packages/ui-default/backendlib/markdown-it-xss.js b/packages/ui-default/backendlib/markdown-it-xss.js index ed71dcb66..bc7664335 100644 --- a/packages/ui-default/backendlib/markdown-it-xss.js +++ b/packages/ui-default/backendlib/markdown-it-xss.js @@ -24,17 +24,17 @@ const xss = new Xss.FilterXSS({ dd: [], del: ['datetime'], details: ['open'], - div: ['class'], + div: ['id','class'], dl: [], dt: [], em: [], font: ['color', 'size', 'face'], - h1: [], - h2: ['class'], - h3: [], - h4: [], - h5: [], - h6: [], + h1: ['id'], + h2: ['id','class'], + h3: ['id'], + h4: ['id'], + h5: ['id'], + h6: ['id'], header: [], hr: [], i: [], @@ -52,7 +52,7 @@ const xss = new Xss.FilterXSS({ sub: [], summary: [], sup: [], - strong: [], + strong: ['id'], table: ['width', 'border', 'align', 'valign'], tbody: ['align', 'valign'], td: ['width', 'rowspan', 'colspan', 'align', 'valign', 'bgcolor'], @@ -66,6 +66,10 @@ const xss = new Xss.FilterXSS({ var: [], video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width'], }, + safeAttrValue(tag, name, value) { + if (name === 'id') return `xss-id-${value}`; + return value; + }, }); function xssProtector(md) {