게시물 HTML 블록 분리

lib/markdown-html-block.js

@@ -0,0 +1,35 @@
+const DANGEROUS_TAG_NAMES = [
+  'script',
+  'iframe',
+  'object',
+  'embed',
+  'form',
+  'input',
+  'button',
+  'textarea',
+  'select',
+  'meta',
+  'link',
+  'base'
+]
+
+const dangerousTagPattern = new RegExp(`<\\s*(${DANGEROUS_TAG_NAMES.join('|')})\\b[\\s\\S]*?<\\s*\\/\\s*\\1\\s*>`, 'gi')
+const dangerousSingleTagPattern = new RegExp(`<\\s*(${DANGEROUS_TAG_NAMES.join('|')})\\b[^>]*\\/?>`, 'gi')
+
+/**
+ * 본문 HTML 블록에서 실행성 코드와 위험 속성을 제거한다.
+ * @param {string} value - 원본 HTML
+ * @returns {string} 정리된 HTML
+ */
+export const sanitizeHtmlBlock = (value) => String(value || '')
+  .replace(dangerousTagPattern, '')
+  .replace(dangerousSingleTagPattern, '')
+  .replace(/\s+on[a-z]+\s*=\s*"[^"]*"/gi, '')
+  .replace(/\s+on[a-z]+\s*=\s*'[^']*'/gi, '')
+  .replace(/\s+on[a-z]+\s*=\s*[^\s>]+/gi, '')
+  .replace(/\s+(href|src)\s*=\s*"javascript:[^"]*"/gi, '')
+  .replace(/\s+(href|src)\s*=\s*'javascript:[^']*'/gi, '')
+  .replace(/\s+(href|src)\s*=\s*javascript:[^\s>]+/gi, '')
+  .replace(/\s+style\s*=\s*"[^"]*expression\s*\([^"]*"/gi, '')
+  .replace(/\s+style\s*=\s*'[^']*expression\s*\([^']*'/gi, '')
+  .trim()