fix: sanitize Org previews before trusting rendered HTML

public/asset-manifest.json

@@ -1,6 +1,6 @@
 {
   "core.min.js": "core.6332b3c288.min.js",
-  "vendor.min.js": "vendor.a5d94d956f.min.js",
+  "vendor.min.js": "vendor.1020f4867e.min.js",
   "mermaid.min.js": "mermaid.f848a72d16.min.js",
   "all.min.css": "all.99ce8f3e14.min.css"
 }

public/script/app.js

@@ -2961,7 +2961,7 @@ angular
                   suppressSubScriptHandling: true,
                   suppressAutoLink: false,
                 });
-                $scope.content = $sce.trustAsHtml(orgHTMLDocument.toString());
+                $scope.content = $sce.trustAsHtml(DOMPurify.sanitize(orgHTMLDocument.toString()));
                 $scope.type = "html";
               }
               if (

test/frontend-regressions.test.js

@@ -66,4 +66,12 @@ describe("frontend production regressions", function () {
     expect(template).to.include("treeNodes");
     expect(h.scope.treeNodes[0].path).to.equal("/constructor/index.js");
   });
+  it("sanitizes Org output before trusting it", async function () {
+    const h = explorer(); let untrusted;
+    h.context.Org = { Parser: function () { this.parse = () => ({ convert: () => ({ toString: () => '<img onerror="probe()">' }) }); }, ConverterHTML: {} };
+    h.context.contentAbs2Relative = x => x;
+    h.context.DOMPurify = { sanitize: html => { untrusted = html; return "sanitized"; } };
+    h.navigate("file.org"); h.requests.at(-1).resolve({ data: "org source", headers: () => "text/plain" }); await h.flush();
+    expect(untrusted).to.include("onerror"); expect(h.scope.content).to.equal("sanitized");
+  });
 });