diff --git a/frontend/components/global/SafeMarkdown.vue b/frontend/components/global/SafeMarkdown.vue index 5c2b70a2a..030080a4e 100644 --- a/frontend/components/global/SafeMarkdown.vue +++ b/frontend/components/global/SafeMarkdown.vue @@ -25,9 +25,18 @@ export default defineComponent({ } const sanitized = DOMPurify.sanitize(rawHtml, { - // TODO: some more thought could be put into what is allowed and what isn't - ALLOWED_TAGS: ["img", "div", "p", "iframe"], - ADD_ATTR: ["src", "alt", "height", "width", "class", "allow", "title", "allowfullscreen", "frameborder", "scrolling"], + // List based on + // https://support.zendesk.com/hc/en-us/articles/4408824584602-Allowing-unsafe-HTML-in-help-center-articles + ALLOWED_TAGS: [ + "strong", "em", "b", "i", "u", "p", "code", "pre", "samp", "kbd", "var", "sub", "sup", "dfn", "cite", + "small", "address", "hr", "br", "id", "div", "span", "h1", "h2", "h3", "h4", "h5", "h6", + "ul", "ol", "li", "dl", "dt", "dd", "abbr", "a", "img", "blockquote", "iframe", + "del", "ins", "table", "thead", "tbody", "tfoot", "tr", "th", "td", "colgroup", + ], + ADD_ATTR: [ + "href", "src", "alt", "height", "width", "class", "allow", "title", "allowfullscreen", "frameborder", + "scrolling", "cite", "datetime", "name", "abbr", "target", "border", + ], }); return sanitized;