Upgrade to latest marked and dompurify libs

Gruntfile.js

@@ -193,7 +193,8 @@ module.exports = function(grunt) {
                         "packages/node_modules/@node-red/editor-client/src/vendor/jquery/js/jquery-migrate-3.0.1.min.js",
                         "packages/node_modules/@node-red/editor-client/src/vendor/jquery/js/jquery-ui.min.js",
                         "packages/node_modules/@node-red/editor-client/src/vendor/jquery/js/jquery.ui.touch-punch.min.js",
-                        "packages/node_modules/@node-red/editor-client/src/vendor/marked/marked.min.js",
+                        "node_modules/marked/marked.min.js",
+                        "node_modules/dompurify/dist/purify.min.js",
                         "packages/node_modules/@node-red/editor-client/src/vendor/d3/d3.v3.min.js",
                         "packages/node_modules/@node-red/editor-client/src/vendor/i18next/i18next.min.js",
                         "node_modules/jsonata/jsonata-es5.min.js",

package.json

@@ -75,6 +75,8 @@
         "bcrypt": "3.0.6"
     },
     "devDependencies": {
+        "marked": "0.8.0",
+        "dompurify": "2.0.8",
         "grunt": "~1.0.4",
         "grunt-chmod": "~1.1.1",
         "grunt-cli": "~1.3.2",

packages/node_modules/@node-red/editor-client/src/js/red.js

@@ -431,7 +431,7 @@ var RED = (function() {
             '<img width="50px" src="red/images/node-red-icon.svg" />'+
             '</div>';
 
-            RED.sidebar.info.set(aboutHeader+marked(data));
+            RED.sidebar.info.set(aboutHeader+RED.utils.renderMarkdown(data));
             RED.sidebar.info.show();
         });
     }

packages/node_modules/@node-red/editor-client/src/js/ui/editors/expression.js

@@ -102,7 +102,7 @@
                         var f = $(this).val();
                         var args = RED._('jsonata:'+f+".args",{defaultValue:''});
                         var title = "<h5>"+f+"("+args+")</h5>";
-                        var body = marked(RED._('jsonata:'+f+'.desc',{defaultValue:''}));
+                        var body = RED.utils.renderMarkdown(RED._('jsonata:'+f+'.desc',{defaultValue:''}));
                         $("#red-ui-editor-type-expression-help").html(title+"<p>"+body+"</p>");
 
                     })

packages/node_modules/@node-red/editor-client/src/js/ui/editors/markdown.js

@@ -107,7 +107,7 @@
                         clearTimeout(changeTimer);
                         changeTimer = setTimeout(function() {
                             var currentScrollTop = $(".red-ui-editor-type-markdown-panel-preview").scrollTop();
-                            $(".red-ui-editor-type-markdown-panel-preview").html(marked(expressionEditor.getValue()));
+                            $(".red-ui-editor-type-markdown-panel-preview").html(RED.utils.renderMarkdown(expressionEditor.getValue()));
                             $(".red-ui-editor-type-markdown-panel-preview").scrollTop(currentScrollTop);
                         },200);
                     })
@@ -116,7 +116,7 @@
                     }
 
                     if (value) {
-                        $(".red-ui-editor-type-markdown-panel-preview").html(marked(expressionEditor.getValue()));
+                        $(".red-ui-editor-type-markdown-panel-preview").html(RED.utils.renderMarkdown(expressionEditor.getValue()));
                     }
                     panels = RED.panels.create({
                         id:"red-ui-editor-type-markdown-panels",

packages/node_modules/@node-red/editor-client/src/js/ui/palette.js

@@ -269,7 +269,7 @@ RED.palette = (function() {
                 RED.view.focus();
                 var helpText;
                 if (nt.indexOf("subflow:") === 0) {
-                    helpText = marked(RED.nodes.subflow(nt.substring(8)).info||"")||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>');
+                    helpText = RED.utils.renderMarkdown(RED.nodes.subflow(nt.substring(8)).info||"")||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>');
                 } else {
                     helpText = $("script[data-help-name='"+d.attr("data-palette-type")+"']").html()||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>');
                 }
@@ -370,7 +370,7 @@ RED.palette = (function() {
                     RED.workspaces.show(nt.substring(8));
                     e.preventDefault();
                 });
-                nodeInfo = marked(def.info||"");
+                nodeInfo = RED.utils.renderMarkdown(def.info||"");
             }
             setLabel(nt,d,label,nodeInfo);
 
@@ -440,7 +440,7 @@ RED.palette = (function() {
             } else if (portOutput.length !== 0 && sf.out.length === 0) {
                 portOutput.remove();
             }
-            setLabel(sf.type+":"+sf.id,paletteNode,sf.name,marked(sf.info||""));
+            setLabel(sf.type+":"+sf.id,paletteNode,sf.name,RED.utils.renderMarkdown(sf.info||""));
             setIcon(paletteNode,sf);
 
             var currentCategory = paletteNode.data('category');

packages/node_modules/@node-red/editor-client/src/js/ui/projects/projectSettings.js

@@ -158,7 +158,7 @@ RED.projects.settings = (function() {
         container.empty();
         var desc;
         if (activeProject.description) {
-            desc = marked(activeProject.description);
+            desc = RED.utils.renderMarkdown(activeProject.description);
         } else {
             desc = '<span class="red-ui-help-info-none">' + RED._("sidebar.project.noDescriptionAvailable") + '</span>';
         }

packages/node_modules/@node-red/editor-client/src/js/ui/tab-info.js

@@ -15,17 +15,6 @@
  **/
 RED.sidebar.info = (function() {
 
-    marked.setOptions({
-        renderer: new marked.Renderer(),
-        gfm: true,
-        tables: true,
-        breaks: false,
-        pedantic: false,
-        sanitize: true,
-        smartLists: true,
-        smartypants: false
-    });
-
     var content;
     var sections;
     var propertiesSection;
@@ -314,7 +303,7 @@ RED.sidebar.info = (function() {
                 if (subflowNode && node.type !== "subflow") {
                     // Selected a subflow instance node.
                     // - The subflow template info goes into help
-                    helpText = (marked(subflowNode.info||"")||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>'));
+                    helpText = (RED.utils.renderMarkdown(subflowNode.info||"")||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>'));
                 } else {
                     helpText = $("script[data-help-name='"+node.type+"']").html()||('<span class="red-ui-help-info-none">'+RED._("sidebar.info.none")+'</span>');
                 }
@@ -326,10 +315,10 @@ RED.sidebar.info = (function() {
             if (node._def && node._def.info) {
                 var info = node._def.info;
                 var textInfo = (typeof info === "function" ? info.call(node) : info);
-                infoText = infoText + marked(textInfo);
+                infoText = infoText + RED.utils.renderMarkdown(textInfo);
             }
             if (node.info) {
-                infoText = infoText + marked(node.info || "")
+                infoText = infoText + RED.utils.renderMarkdown(node.info || "")
             }
             setInfoText(infoText, infoSection.content);
 

packages/node_modules/@node-red/editor-client/src/js/ui/utils.js

@@ -16,6 +16,28 @@
 
 RED.utils = (function() {
 
+    window._marked = window.marked;
+    window.marked = function(txt) {
+        console.warn("Use of 'marked()' is deprecated. Use RED.utils.renderMarkdown() instead");
+        return renderMarkdown(txt);
+    }
+
+    _marked.setOptions({
+        renderer: new _marked.Renderer(),
+        gfm: true,
+        tables: true,
+        breaks: false,
+        pedantic: false,
+        smartLists: true,
+        smartypants: false
+    });
+
+    function renderMarkdown(txt) {
+        var rendered = _marked(txt);
+        var cleaned = DOMPurify.sanitize(rendered, {SAFE_FOR_JQUERY: true})
+        return cleaned;
+    }
+
     function formatString(str) {
         return str.replace(/\r?\n/g,"↵").replace(/\t/g,"→");
     }
@@ -1053,6 +1075,7 @@ RED.utils = (function() {
         decodeObject: decodeObject,
         parseContextKey: parseContextKey,
         createIconElement: createIconElement,
-        sanitize: sanitize
+        sanitize: sanitize,
+        renderMarkdown: renderMarkdown
     }
 })();