From 5c72e4e66893d997c9c43c312281915dd8e13fbf Mon Sep 17 00:00:00 2001
From: Johannes Schill <johannes.schill@polyester.se>
Date: Wed, 23 Jan 2019 11:27:02 +0100
Subject: [PATCH] fix: Use custom whitelist for XSS sanitizer to allow class
 and style attributes

---
 public/app/core/utils/text.ts | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/public/app/core/utils/text.ts b/public/app/core/utils/text.ts
index 9f4f1c41716..427b0102c95 100644
--- a/public/app/core/utils/text.ts
+++ b/public/app/core/utils/text.ts
@@ -44,9 +44,25 @@ export function findMatchesInText(haystack: string, needle: string): TextMatch[]
   return matches;
 }
 
+const XSSWL = Object.keys(xss.whiteList).reduce((acc, element) => {
+  acc[element] = xss.whiteList[element].concat(['class', 'style']);
+  return acc;
+}, {});
+
+const sanitizeXSS = new xss.FilterXSS({
+  whiteList: XSSWL
+});
+
+/**
+ * Returns string safe from XSS attacks.
+ *
+ * Even though we allow the style-attribute, there's still default filtering applied to it
+ * Info: https://github.com/leizongmin/js-xss#customize-css-filter
+ * Whitelist: https://github.com/leizongmin/js-css-filter/blob/master/lib/default.js
+ */
 export function sanitize (unsanitizedString: string): string {
   try {
-    return xss(unsanitizedString);
+    return sanitizeXSS.process(unsanitizedString);
   } catch (error) {
     console.log('String could not be sanitized', unsanitizedString);
     return unsanitizedString;