Cross-Site Scripting (XSS) attacks are a type of injection attack, in which malicious scripts are injected into otherwise benign and trusted websites. In case you are developing a Zimlet you should not trust any form of user input. If you integrate 3rd party services via your Zimlet, you probably also want to sanitize any data you receive from that 3rd party application.
Zimbra Modern UI includes DOMPurify that you can use in your Zimlet for your XSS sanitizing needs. Here is a basic example:
//Load components from Zimbra
import { createElement } from "preact";
import dompurify from 'dompurify';
//Create function by Zimbra convention
export default function Zimlet(context) {
const { plugins } = context;
const exports = {};
exports.init = function init() {
let clean = dompurify.sanitize('<b>hello there</b>');
console.log(clean); //prints: <b>hello there</b>
clean = dompurify.sanitize('<img src=x onerror=alert(1)//>');
console.log(clean);//prints: <img src="x">
};
return exports;
}
Further reading:
Comments are closed.