Clientside output purifying (#824)

friendsofhyperf · Jan 7, 2025 · fe86bd5 · fe86bd5
1 parent 6c293b7
commit fe86bd5
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 4 deletions.
diff --git a/src/web-tinker/package.json b/src/web-tinker/package.json
@@ -24,6 +24,7 @@
         "prettier": "^1.15.3",
         "split-grid": "^1.0.9",
         "tailwindcss": "^0.7.2",
-        "vue": "^2.5.7"
+        "vue": "^2.5.7",
+        "dompurify": "^3.2.3"
     }
 }
diff --git a/src/web-tinker/public/app.js b/src/web-tinker/public/app.js
diff --git a/src/web-tinker/resources/js/components/Tinker.vue b/src/web-tinker/resources/js/components/Tinker.vue
@@ -10,6 +10,7 @@
 import TinkerInput from './TinkerInput';
 import TinkerOutput from './TinkerOutput';
 import Split from 'split-grid';
+import DOMPurify from 'dompurify';
 
 export default {
     components: {
@@ -56,7 +57,7 @@ export default {
 
     methods: {
         handleExecute(output) {
-            this.output = output;
+            this.output = DOMPurify.sanitize(output);
         },
 
         initSplit() {

diff --git a/src/web-tinker/src/Tinker.php b/src/web-tinker/src/Tinker.php
@@ -127,6 +127,6 @@ protected function cleanOutput(string $output): string
         // Remove ANSI color codes
         $output = preg_replace('/\e\[[0-9;]*m/', '', $output);
 
-        return htmlentities($output);
+        return trim($output);
     }
 }