Andrey/uptime-kuma
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added direct text support for countering xss and test were also failing

Browse Source
This commit is contained in:
lsnnt 2025-12-31 10:55:23 +05:30
parent bdf499edd2
commit 6c3afcca08
1 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
server/notification-providers/resend.js
View File

@ -1,11 +1,5 @@
const NotificationProvider = require("./notification-provider"); const NotificationProvider = require("./notification-provider");
const axios = require("axios"); const axios = require("axios");
const { JSDOM } = require("jsdom");
const createDOMPurify = require("dompurify");
// Initialize a server-side DOMPurify using JSDOM. Created once per module.
const window = new JSDOM("").window;
const DOMPurify = createDOMPurify(window);
class Resend extends NotificationProvider { class Resend extends NotificationProvider {
name = "Resend"; name = "Resend";
@ -31,10 +25,8 @@ class Resend extends NotificationProvider {
from: `${fromName} <${email}>`, from: `${fromName} <${email}>`,
to: notification.resendToEmail, to: notification.resendToEmail,
subject: notification.resendSubject || "Notification from Your Uptime Kuma", subject: notification.resendSubject || "Notification from Your Uptime Kuma",
// sanitize the message content to avoid injecting unsafe HTML // supplied text directly instead of html
html: `<html><head></head><body>${DOMPurify.sanitize(msg.replace(/\n/g, "<br/>"), { text:msg,
ALLOWED_TAGS: [ "b", "i", "br" ],
})}</body></html>`
}; };
let result = await axios.post( let result = await axios.post(