Merge commit from fork

fixed: sanitize rendered HTML

Author: commenthol

lib/markd.js

@@ -8,6 +8,11 @@ const md = require('markdown-it')
 const confluencer = require('confluencer')
 const { newError, contentSecurityPolicy } = require('./utils.js')
 
+const createDOMPurify = require('dompurify')
+const { JSDOM } = require('jsdom')
+const window = (new JSDOM('')).window
+const DOMPurify = createDOMPurify(window)
+
 const tmpl = fs.readFileSync(path.resolve(__dirname, 'pages', 'template.html'))
 
 const markedppP = promisify(markedpp)
@@ -39,6 +44,7 @@ async function markdown(title, data, config) {
   config.markdownItPlugins(mdIt)
 
   let _data = mdIt.render(data)
+  _data = DOMPurify.sanitize(_data, { USE_PROFILES: { html: true } })
 
   if (config.confluencer) {
     const confluenceHtml =