wikijs/server/modules/rendering/html-security/renderer.js

const xss = require('xss')

module.exports = {
  async init(input, config) {
    if (config.safeHTML) {
      input = xss(input, {
        whiteList: {
          ...xss.whiteList,
          a: ['class', 'id', 'href', 'style', 'target', 'title'],
          blockquote: ['class', 'id', 'style'],
          code: ['class', 'style'],
          details: ['class', 'style'],
          defs: ['stroke', 'fill', 'stroke-width', 'transform'],
          div: ['class', 'id', 'style'],
          em: ['class', 'style'],
          figcaption: ['class', 'style'],
          figure: ['class', 'style'],
          g: ['transform', 'stroke', 'stroke-width', 'fill'],
          h1: ['class', 'id', 'style'],
          h2: ['class', 'id', 'style'],
          h3: ['class', 'id', 'style'],
          h4: ['class', 'id', 'style'],
          h5: ['class', 'id', 'style'],
          h6: ['class', 'id', 'style'],
          i: ['class', 'style'],
          img: ['alt', 'class', 'draggable', 'height', 'src', 'style', 'width'],
          input: ['class', 'disabled', 'type', 'checked', 'id'],
          kbd: ['class'],
          label: ['class', 'id', 'for'],
          li: ['class', 'style'],
          mark: ['class', 'style'],
          ol: ['class', 'style', 'start'],
          p: ['class', 'style'],
          path: ['d', 'style', 'id'],
          pre: ['class', 'style'],
          section: ['class', 'style'],
          span: ['class', 'style', 'aria-hidden'],
          strong: ['class', 'style'],
          summary: ['class', 'style'],
          svg: ['width', 'height', 'viewbox', 'preserveaspectratio', 'style'],
          table: ['border', 'class', 'id', 'style', 'width'],
          tabset: [],
          tbody: ['class', 'style'],
          td: ['align', 'class', 'colspan', 'rowspan', 'style', 'valign'],
          template: ['v-slot:tabs', 'v-slot:content'],
          th: ['align', 'class', 'colspan', 'rowspan', 'style', 'valign'],
          thead: ['class', 'style'],
          tr: ['class', 'rowspan', 'style', 'align', 'valign'],
          ul: ['class', 'style'],
          use: ['href', 'transform']
        },
        css: false
      })
    }
    return input
  }
}