ui: add xss filter to id attribute (#232)

packages/ui-default/backendlib/markdown-it-xss.js

@@ -24,17 +24,17 @@ const xss = new Xss.FilterXSS({
     dd: [],
     del: ['datetime'],
     details: ['open'],
-    div: ['class'],
+    div: ['id','class'],
     dl: [],
     dt: [],
     em: [],
     font: ['color', 'size', 'face'],
-    h1: [],
+    h1: ['id'],
-    h2: ['class'],
+    h2: ['id','class'],
-    h3: [],
+    h3: ['id'],
-    h4: [],
+    h4: ['id'],
-    h5: [],
+    h5: ['id'],
-    h6: [],
+    h6: ['id'],
     header: [],
     hr: [],
     i: [],
@@ -52,7 +52,7 @@ const xss = new Xss.FilterXSS({
     sub: [],
     summary: [],
     sup: [],
-    strong: [],
+    strong: ['id'],
     table: ['width', 'border', 'align', 'valign'],
     tbody: ['align', 'valign'],
     td: ['width', 'rowspan', 'colspan', 'align', 'valign', 'bgcolor'],
@@ -66,6 +66,10 @@ const xss = new Xss.FilterXSS({
     var: [],
     video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width'],
   },
+  safeAttrValue(tag, name, value) {
+    if (name === 'id') return `xss-id-${value}`;
+    return value;
+  },
 });
 
 function xssProtector(md) {