diff --git a/html-to-react/.eslintrc.json b/html-to-react/.eslintrc.json new file mode 100644 index 000000000..8899fa3ff --- /dev/null +++ b/html-to-react/.eslintrc.json @@ -0,0 +1,36 @@ +/* + * SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file) + * + * SPDX-License-Identifier: AGPL-3.0-only + */ +{ + "parser": "@typescript-eslint/parser", + "parserOptions": { + "project": [ + "./tsconfig.test.json" + ] + }, + "plugins": [ + "@typescript-eslint", + "jest", + "prettier" + ], + "env": { + "jest": true, + "jest/globals": true + }, + "extends": [ + "eslint:recommended", + "plugin:@typescript-eslint/eslint-recommended", + "plugin:@typescript-eslint/recommended", + "prettier" + ], + "rules": { + "prettier/prettier": "error", + "jest/no-disabled-tests": "warn", + "jest/no-focused-tests": "error", + "jest/no-identical-title": "error", + "jest/prefer-to-have-length": "warn", + "jest/valid-expect": "error" + } +} diff --git a/html-to-react/.npmignore b/html-to-react/.npmignore new file mode 100644 index 000000000..b47b7d1c5 --- /dev/null +++ b/html-to-react/.npmignore @@ -0,0 +1,9 @@ +.idea +.babelrc +.eslintrc +.travis.yml +karma.conf.js +tests.webpack.js +webpack.config.*.js +coverage/ +test/ \ No newline at end of file diff --git a/html-to-react/.npmignore.license b/html-to-react/.npmignore.license new file mode 100644 index 000000000..c223474fb --- /dev/null +++ b/html-to-react/.npmignore.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file) + +SPDX-License-Identifier: CC0-1.0 diff --git a/html-to-react/.prettierignore b/html-to-react/.prettierignore new file mode 100644 index 000000000..c2658d7d1 --- /dev/null +++ b/html-to-react/.prettierignore @@ -0,0 +1 @@ +node_modules/ diff --git a/html-to-react/.prettierignore.license b/html-to-react/.prettierignore.license new file mode 100644 index 000000000..b29776d49 --- /dev/null +++ b/html-to-react/.prettierignore.license @@ -0,0 +1,4 @@ +SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file) + +SPDX-License-Identifier: CC0-1.0 + diff --git a/html-to-react/.prettierrc.json b/html-to-react/.prettierrc.json new file mode 100644 index 000000000..3421bdfba --- /dev/null +++ b/html-to-react/.prettierrc.json @@ -0,0 +1,11 @@ +{ + "parser": "typescript", + "singleQuote": true, + "jsxSingleQuote": true, + "semi": false, + "tabWidth": 2, + "trailingComma": "none", + "bracketSpacing": true, + "bracketSameLine": true, + "arrowParens": "always" +} diff --git a/html-to-react/.prettierrc.json.license b/html-to-react/.prettierrc.json.license new file mode 100644 index 000000000..c223474fb --- /dev/null +++ b/html-to-react/.prettierrc.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file) + +SPDX-License-Identifier: CC0-1.0 diff --git a/html-to-react/README.md b/html-to-react/README.md new file mode 100644 index 000000000..fc795e0b9 --- /dev/null +++ b/html-to-react/README.md @@ -0,0 +1,143 @@ + + +# HTML to React + +This is a library that renders HTML strings into [React](https://facebook.github.io/react/) components without using `dangerouslySetInnerHTML`. Converts standard HTML elements, attributes and inline styles into their React equivalents and provides a simple way to modify and replace the content. + +This library is a hard fork of https://github.com/peternewnham/react-html-parser. It has some improvements and is converted to typescript. + +[![npm](https://img.shields.io/npm/v/@hedgedoc/html-to-react.svg)](https://www.npmjs.com/package/@hedgedoc/html-to-react) +[![Downloads](https://img.shields.io/npm/dw/@hedgedoc/html-to-react.svg)](https://www.npmjs.com/package/@hedgedoc/html-to-react) + +## Install + +```bash +npm install @hedgedoc/html-to-react +# or +yarn add @hedgedoc/html-to-react +``` + +## Usage + +```typescript +import React from 'react'; +import { convertHtmlToReact } from '@hedgedoc/html-to-react'; + +class HtmlComponent extends React.Component { + render() { + const html = '
Example HTML string
'; + return
{ convertHtmlToReact(html) }
; + } +} +``` + +## Security + +It is important to understand that this library should not be used as a direct replacement for using properly sanitized HTML and that it only provides the same level of protection that React does which does not provide 100% protection. All HTML should be properly sanitized using a dedicated sanitisation library (such as [dompurify](https://www.npmjs.com/package/dompurify) for node/js) before being passed to this library to ensure that you are fully protected from [malicious injections](https://en.wikipedia.org/wiki/Cross-site_scripting). + +### What doesn't React protect me from? + +Whilst React has a [certain level of protection to injection attacks](https://reactjs.org/docs/introducing-jsx.html#jsx-prevents-injection-attacks) built into it, it doesn't cover everything, for example: +* xss via iframe src: `