dmxAppConnect.js SAST vulnerability

[patrick]

As the suggested fix already explains you need to sanitize the html, you can create a custom formatter for App Connect that does this.

Writing Custom Formatters for App Connect

Introduction Writing your own formatters can be easily done if you have common knowledge about JavaScript. We will explain how you register your own formatters and give some samples. Formatters are registered for a specific data type, the types available in App Connect are string, number, boolean, array, object, and null. There are also some special types undefined, global and any. We will explain them all in some examples. There are 2 ways to register formatters, the first is registering a si…

GitHub - apostrophecms/sanitize-html: Clean up user-submitted HTML, preserving...

Formatter using sanitize-html

import sanitizeHtml from 'sanitize-html';

dmx.Formatter('string', 'sanitizeHtml', (html, options) => {
  return sanitizeHtml(html, options);
});

You can then use it in expressions like dmx-html="email.body.sanitizeHtml()"

They don't offer a browser ready script anymore, so you have to use some bundler to build the code for the formatter.