diff --git a/packages/twenty-front/src/modules/advanced-text-editor/utils/__tests__/sanitizeHtmlPreview.test.ts b/packages/twenty-front/src/modules/advanced-text-editor/utils/__tests__/sanitizeHtmlPreview.test.ts index a9d53addc6..09ff81d683 100644 --- a/packages/twenty-front/src/modules/advanced-text-editor/utils/__tests__/sanitizeHtmlPreview.test.ts +++ b/packages/twenty-front/src/modules/advanced-text-editor/utils/__tests__/sanitizeHtmlPreview.test.ts @@ -53,6 +53,19 @@ describe('sanitizeHtmlPreview', () => { ).toContain('data:image/png'); }); + it('should remove templates instead of leaving their handlers unreachable', () => { + expect( + sanitizeHtmlPreview( + '', + ), + ).toBe(''); + expect( + sanitizeHtmlPreview( + '
', + ), + ).toBe('
'); + }); + it('should strip srcdoc and formaction attributes', () => { expect( sanitizeHtmlPreview('
a
'), diff --git a/packages/twenty-front/src/modules/advanced-text-editor/utils/sanitizeHtmlPreview.ts b/packages/twenty-front/src/modules/advanced-text-editor/utils/sanitizeHtmlPreview.ts index 3638d76959..9501658c8d 100644 --- a/packages/twenty-front/src/modules/advanced-text-editor/utils/sanitizeHtmlPreview.ts +++ b/packages/twenty-front/src/modules/advanced-text-editor/utils/sanitizeHtmlPreview.ts @@ -1,5 +1,5 @@ const BLOCKED_ELEMENT_SELECTOR = - 'script, iframe, frame, object, embed, link, meta, base, style, svg, math'; + 'script, iframe, frame, object, embed, link, meta, base, style, svg, math, template'; const URL_ATTRIBUTE_NAMES = ['href', 'src', 'xlink:href', 'action'];