← back to Norma

components/email-analyzer/sanitize.ts

17 lines

/**
 * Basic HTML sanitizer -- strips script tags, event handlers, and dangerous attributes.
 * This is user-pasted email content being previewed back to the same user, so risk is low,
 * but we still sanitize as defense-in-depth.
 */
export function sanitizeHtml(html: string): string {
  return html
    .replace(/<script[\s\S]*?<\/script>/gi, '')
    .replace(/<style[\s\S]*?<\/style>/gi, '')
    .replace(/\son\w+\s*=/gi, ' data-removed=')
    .replace(/javascript\s*:/gi, 'removed:')
    .replace(/<iframe[\s\S]*?<\/iframe>/gi, '')
    .replace(/<object[\s\S]*?<\/object>/gi, '')
    .replace(/<embed[\s\S]*?>/gi, '')
    .replace(/<form[\s\S]*?<\/form>/gi, '');
}