[FIX] Sanitize styles in message (#25744)

4 years ago · b89ebfff4f
parent 707a62263e
commit b89ebfff4f
1 changed files with 1 additions and 1 deletions
--- a/apps/meteor/app/markdown/lib/parser/marked/marked.js
+++ b/apps/meteor/app/markdown/lib/parser/marked/marked.js
@ -100,7 +100,7 @@ export const marked = (message, { marked: { gfm, tables, breaks, pedantic, smart

 	const window = getGlobalWindow();
 	const DomPurify = createDOMPurify(window);
-	message.html = DomPurify.sanitize(message.html, { ADD_ATTR: ['target'] });
+	message.html = DomPurify.sanitize(message.html, { ADD_ATTR: ['target'], FORBID_ATTR: ['style'], FORBID_TAGS: ['style'] });

 	return message;
 };