Merge pull request #1378 from nscuro/welcome-message-dompurify

Author: nscuro

src/views/administration/configuration/WelcomeMessage.vue

@@ -46,7 +46,7 @@
             <div slot="header">
               <h4>{{ $t('admin.preview') }}</h4>
             </div>
-            <p><span v-html="welcomeMessage" /></p>
+            <p><span v-html="sanitizedWelcomeMessage" /></p>
           </b-card>
         </b-col>
       </b-row>
@@ -58,6 +58,7 @@ import axios from 'axios';
 import { Switch as cSwitch } from '@coreui/vue';
 import configPropertyMixin from '../mixins/configPropertyMixin';
 import common from '../../../shared/common';
+import DOMPurify from 'dompurify';
 
 export default {
   mixins: [configPropertyMixin],
@@ -83,7 +84,11 @@ export default {
       this.isWelcomeMessage = common.toBoolean(response.data.propertyValue);
     });
   },
-  computed: {},
+  computed: {
+    sanitizedWelcomeMessage() {
+      return DOMPurify.sanitize(this.welcomeMessage);
+    },
+  },
   methods: {
     updateCode() {
       const editor = this.$refs.editor;

src/views/pages/Login.vue

@@ -111,6 +111,7 @@ import EventBus from '../../shared/eventbus';
 import { getRedirectUrl, getContextPath } from '../../shared/utils';
 const qs = require('querystring');
 import common from '../../shared/common';
+import DOMPurify from 'dompurify';
 
 export default {
   name: 'Login',
@@ -156,8 +157,8 @@ export default {
         if (this.isWelcomeMessage) {
           let message_url = `${this.$api.BASE_URL}/${this.$api.URL_CONFIG_PROPERTY}/public/general/welcome.message.html`;
           axios.get(message_url).then((response) => {
-            this.welcomeMessage = decodeURIComponent(
-              response.data.propertyValue,
+            this.welcomeMessage = DOMPurify.sanitize(
+              decodeURIComponent(response.data.propertyValue),
             );
           });
         }