From 6b6b996a826598ff934f816803ded53da568dea0 Mon Sep 17 00:00:00 2001
From: orenom <orenom@tutanota.com>
Date: Sun, 18 Jul 2021 11:37:56 +0200
Subject: [PATCH] remove all <script> and <iframe> elements, and remove all JS
 event attributes from all elements

---
 src/utils.js | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/utils.js b/src/utils.js
index 4b2c14c..87c152a 100644
--- a/src/utils.js
+++ b/src/utils.js
@@ -78,8 +78,6 @@ module.exports = function(redis) {
           url = `${url}?${params}`
         }
         
-        let setting_lang = user_preferences.default_lang || config.default_lang
-        
         data.html = parser.parse(data.html)
         
         // insert wikiless styles
@@ -124,6 +122,28 @@ module.exports = function(redis) {
           wikibase_links.remove()
         }
         
+        // remove all <script> elements
+        let script_elements = data.html.querySelectorAll('script')
+        for(let i = 0; i < script_elements.length; i++) {
+          script_elements[i].remove()
+        }
+        
+        // remove all <iframe> elements
+        let iframe_elements = data.html.querySelectorAll('iframe')
+        for(let i = 0; i < iframe_elements.length; i++) {
+          iframe_elements[i].remove()
+        }
+        
+        // remove all JavaScript event attributes
+        let event_attributes = ['[onAbort]', '[onBlur]', '[onChange]', '[onClick]', '[onDblClick]', '[onError]', '[onFocus]', '[onKeydown]', '[onKeypress]', '[onKeyup]', '[onLoad]'
+, '[onMousedown]', '[onMousemove]', '[onMouseout]', '[onMouseover]', '[onMouseUp]', '[onReset]', '[onSelect]', '[onSubmit]', '[onUnload]']
+        let elements_with_event_attr = data.html.querySelectorAll(event_attributes.join(','))
+        for(let i = 0; i < elements_with_event_attr.length; i++) {
+          for(let j = 0; j < event_attributes.length; j++) {
+            elements_with_event_attr.removeAttribute(event_attributes[j])
+          }
+        }
+        
         /**
         * Remove the language subdomain from the sidebar language switchers.
         * Then append the language as a URL query param.