update

eshop/frontend/src/utils/sanitizeHtml.ts

@@ -0,0 +1,28 @@
+import DOMPurify from 'dompurify';
+
+const ADDITIONAL_TAGS = ['iframe'];
+const ADDITIONAL_ATTRS = ['allow', 'allowfullscreen', 'class', 'rel', 'style', 'target'];
+
+export function sanitizeRichHtml(html: string | null | undefined): string {
+  const sanitized = DOMPurify.sanitize(html ?? '', {
+    USE_PROFILES: { html: true },
+    ADD_TAGS: ADDITIONAL_TAGS,
+    ADD_ATTR: ADDITIONAL_ATTRS,
+  });
+
+  if (typeof window === 'undefined' || !sanitized) {
+    return sanitized;
+  }
+
+  const template = window.document.createElement('template');
+  template.innerHTML = sanitized;
+
+  template.content.querySelectorAll<HTMLAnchorElement>('a[target="_blank"]').forEach((anchor) => {
+    const rel = new Set((anchor.getAttribute('rel') ?? '').split(/\s+/).filter(Boolean));
+    rel.add('noopener');
+    rel.add('noreferrer');
+    anchor.setAttribute('rel', Array.from(rel).join(' '));
+  });
+
+  return template.innerHTML;
+}