Merge pull request #355 from aoneill01/feature/sanitize-at-import

feat: sanitize css @import rules

package.json

@@ -25,6 +25,7 @@
   "dependencies": {
     "base64-js": "1.2.1",
     "base64-loader": "1.0.0",
+    "css-tree": "1.1.3",
     "dompurify": "2.2.7",
     "fastestsmallesttextencoderdecoder": "^1.0.22",
     "minilog": "3.1.0",

src/sanitize-svg.js

@@ -3,6 +3,7 @@
  * as possible
  */
 const fixupSvgString = require('./fixup-svg-string');
+const {generate, parse, walk} = require('css-tree');
 const DOMPurify = require('dompurify');
 
 const sanitizeSvg = {};
@@ -30,6 +31,26 @@ DOMPurify.addHook(
     }
 );
 
+DOMPurify.addHook(
+    'uponSanitizeElement',
+    (node, data) => {
+        if (data.tagName === 'style') {
+            const ast = parse(node.textContent);
+            let isModified = false;
+            // Remove any @import rules as it could leak HTTP requests
+            walk(ast, (astNode, item, list) => {
+                if (astNode.type === 'Atrule' && astNode.name === 'import') {
+                    list.remove(item);
+                    isModified = true;
+                }
+            });
+            if (isModified) {
+                node.textContent = generate(ast);
+            }
+        }
+    }
+);
+
 // Use JS implemented TextDecoder and TextEncoder if it is not provided by the
 // browser.
 let _TextDecoder;