fix: harden admin actions, search, sanitization and repo hygiene

- Split approve/dismiss application workflows with distinct audit logs,
  rate-limited guards and real error logging
- Validate article status/date/id input and stop resetting publishedAt
  on every update
- Validate guild updates (state, forum enums, non-empty name) behind
  rate-limited guard
- Fix scheduled-article publishing (ignore NULL dates, set updatedAt,
  type-safe predicates)
- Harden admin search API (LIKE escaping, query cap, per-user
  rate limit, round-robin result cap) and fix search dialog
  abort/res.ok/loading races
- Lock down HTML sanitizer to an allowlist profile and add XSS tests
- Improve mobile nav accessibility (unique id, dialog role, focus
  management, scroll lock, outside close)
- Log swallowed server errors instead of silent catch blocks
- Remove dead eslint config, drop unused dompurify deps, restore knip
  CI step, add Playwright config with smoke spec

src/actions/admin-applications.ts

@@ -2,39 +2,55 @@
 
 import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
-import { requirePermission } from "@/lib/admin/guard";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
 import { db, WebsiteStaffApplications } from "@/lib/db";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
+import { logServerError } from "@/lib/server-log";
+import { logStaffActivity } from "@/lib/services/staff-activity";
 
-export async function dismissApplication(formData: FormData): Promise<void> {
-	await requirePermission(PERMS.USERS_EDIT);
-	const id = formPositiveBigInt(formData, "id");
-	if (!id) return;
-
+async function removeApplication(id: bigint): Promise<boolean> {
 	try {
 		await db
 			.delete(WebsiteStaffApplications)
 			.where(eq(WebsiteStaffApplications.id, id));
-	} catch {
-		// already gone / no DB — nothing to do
+		return true;
+	} catch (error) {
+		logServerError("applications.delete_failed", error, { id: String(id) });
+		return false;
 	}
+}
+
+export async function dismissApplication(formData: FormData): Promise<void> {
+	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
+	const id = formPositiveBigInt(formData, "id");
+	if (!id) return;
+
+	await removeApplication(id);
+	await logStaffActivity({
+		staffId: staff.id,
+		action: "application_dismiss",
+		description: `Dismissed staff application #${id}`,
+		targetType: "staff_application",
+		targetId: Number(id),
+	});
 
 	revalidatePath("/admin/applications");
 }
 
 export async function approveApplication(formData: FormData): Promise<void> {
-	await requirePermission(PERMS.USERS_EDIT);
+	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;
 
-	try {
-		await db
-			.delete(WebsiteStaffApplications)
-			.where(eq(WebsiteStaffApplications.id, id));
-	} catch {
-		// already gone / no DB — nothing to do
-	}
+	await removeApplication(id);
+	await logStaffActivity({
+		staffId: staff.id,
+		action: "application_approve",
+		description: `Approved staff application #${id}`,
+		targetType: "staff_application",
+		targetId: Number(id),
+	});
 
 	revalidatePath("/admin/applications");
 }

src/actions/admin-articles.ts

@@ -10,10 +10,28 @@ import {
 	WebsiteArticleReactions,
 	WebsiteArticles,
 } from "@/lib/db";
+import { formPositiveBigInt } from "@/lib/form-data";
 import { slugify } from "@/lib/format";
 import { PERMS } from "@/lib/permissions";
 import { notify } from "@/lib/services/webhook";
 
+const ARTICLE_STATUSES = ["published", "scheduled", "draft"] as const;
+type ArticleStatus = (typeof ARTICLE_STATUSES)[number];
+
+function parseArticleStatus(raw: unknown): ArticleStatus {
+	const value = String(raw ?? "published").trim();
+	return (ARTICLE_STATUSES as readonly string[]).includes(value)
+		? (value as ArticleStatus)
+		: "published";
+}
+
+function parsePublishAt(raw: unknown): Date | null {
+	const value = String(raw ?? "").trim();
+	if (!value) return null;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+
 async function uniqueSlug(title: string): Promise<string> {
 	const base = slugify(title);
 	let slug = base;
@@ -44,13 +62,18 @@ export async function createArticle(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 	const rawSlug = String(formData.get("slug") ?? "").trim();
-	const status = String(formData.get("status") ?? "published");
+	const status = parseArticleStatus(formData.get("status"));
 	const rawPublishAt = String(formData.get("publishAt") ?? "").trim();
 	if (!title) return;
+	if (status === "scheduled" && !parsePublishAt(rawPublishAt)) {
+		redirect(
+			"/admin/articles/new?error=Scheduled articles need a valid publish date.",
+		);
+	}
 
 	try {
 		const now = new Date();
-		const publishAt = rawPublishAt ? new Date(rawPublishAt) : null;
+		const publishAt = parsePublishAt(rawPublishAt);
 		const slug = rawSlug ? await uniqueSlug(rawSlug) : await uniqueSlug(title);
 		await db.insert(WebsiteArticles).values({
 			slug,
@@ -61,7 +84,7 @@ export async function createArticle(formData: FormData): Promise<void> {
 			userId: staff.id,
 			createdAt: now,
 			updatedAt: now,
-			status: status || "published",
+			status,
 			publishAt,
 			publishedAt: status === "published" ? now : null,
 		});
@@ -83,12 +106,28 @@ export async function createArticle(formData: FormData): Promise<void> {
 
 export async function updateArticle(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.NEWS_EDIT);
-	const id = BigInt(String(formData.get("id")));
+	const id = formPositiveBigInt(formData, "id");
+	if (!id) redirect("/admin/articles?error=Missing article id");
 	const rawSlug = String(formData.get("slug") ?? "").trim();
-	const status = String(formData.get("status") ?? "published");
+	const status = parseArticleStatus(formData.get("status"));
 	const rawPublishAt = String(formData.get("publishAt") ?? "").trim();
+	if (status === "scheduled" && !parsePublishAt(rawPublishAt)) {
+		redirect(
+			"/admin/articles?error=Scheduled articles need a valid publish date.",
+		);
+	}
 	try {
-		const publishAt = rawPublishAt ? new Date(rawPublishAt) : null;
+		const publishAt = parsePublishAt(rawPublishAt);
+		const [existing] = await db
+			.select({
+				status: WebsiteArticles.status,
+				publishedAt: WebsiteArticles.publishedAt,
+			})
+			.from(WebsiteArticles)
+			.where(eq(WebsiteArticles.id, id))
+			.limit(1);
+		const publishedAt =
+			status === "published" ? (existing?.publishedAt ?? new Date()) : null;
 		await db
 			.update(WebsiteArticles)
 			.set({
@@ -110,7 +149,7 @@ export async function updateArticle(formData: FormData): Promise<void> {
 					.slice(0, 255),
 				status,
 				publishAt,
-				publishedAt: status === "published" ? new Date() : undefined,
+				publishedAt,
 				updatedAt: new Date(),
 			})
 			.where(eq(WebsiteArticles.id, id));
@@ -123,7 +162,8 @@ export async function updateArticle(formData: FormData): Promise<void> {
 
 export async function deleteArticle(formData: FormData): Promise<void> {
 	const staff = await requirePermission(PERMS.NEWS_EDIT);
-	const id = BigInt(String(formData.get("id")));
+	const id = formPositiveBigInt(formData, "id");
+	if (!id) redirect("/admin/articles?error=Missing article id");
 	const [article] = await db
 		.select({ title: WebsiteArticles.title })
 		.from(WebsiteArticles)

src/actions/admin-guilds.ts

@@ -2,10 +2,7 @@
 
 import { eq, inArray } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
-import {
-	requirePermission,
-	requirePermissionRateLimited,
-} from "@/lib/admin/guard";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
 import {
 	db,
 	GuildForumViews,
@@ -19,6 +16,33 @@ import {
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+const GUILD_STATES = [0, 1, 2] as const;
+const GUILD_FORUM = ["0", "1"] as const;
+const GUILD_FORUM_ACCESS = [
+	"EVERYONE",
+	"OWNER",
+	"ADMIN",
+	"MEMBER",
+	"NONE",
+] as const;
+const GUILD_MOD_ACCESS = ["ADMINS", "OWNER", "MEMBER", "NONE"] as const;
+
+function parseGuildState(raw: unknown): number | null {
+	const value = Number(raw);
+	return (GUILD_STATES as readonly number[]).includes(value) ? value : null;
+}
+
+function parseEnum<T extends string>(
+	raw: unknown,
+	allowed: readonly T[],
+	fallback: T,
+): T {
+	const value = String(raw ?? fallback).trim();
+	return (allowed as readonly string[]).includes(value)
+		? (value as T)
+		: fallback;
+}
+
 /** Disband a guild and clean related membership/forum rows. */
 export async function disbandGuild(formData: FormData): Promise<void> {
 	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
@@ -68,22 +92,40 @@ export async function disbandGuild(formData: FormData): Promise<void> {
 }
 
 export async function updateGuild(formData: FormData): Promise<void> {
-	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
 	const id = Number(formData.get("id"));
 	if (!(id > 0)) return;
 
 	const name = String(formData.get("name") ?? "")
 		.trim()
 		.slice(0, 50);
+	if (!name) return;
 	const description = String(formData.get("description") ?? "")
 		.trim()
 		.slice(0, 250);
-	const state = Number(formData.get("state"));
-	const forum = String(formData.get("forum") ?? "0");
-	const readForum = String(formData.get("readForum") ?? "EVERYONE");
-	const postMessages = String(formData.get("postMessages") ?? "EVERYONE");
-	const postThreads = String(formData.get("postThreads") ?? "EVERYONE");
-	const modForum = String(formData.get("modForum") ?? "ADMINS");
+	const state = parseGuildState(formData.get("state"));
+	if (state === null) return;
+	const forum = parseEnum(formData.get("forum"), GUILD_FORUM, "0");
+	const readForum = parseEnum(
+		formData.get("readForum"),
+		GUILD_FORUM_ACCESS,
+		"EVERYONE",
+	);
+	const postMessages = parseEnum(
+		formData.get("postMessages"),
+		GUILD_FORUM_ACCESS,
+		"EVERYONE",
+	);
+	const postThreads = parseEnum(
+		formData.get("postThreads"),
+		GUILD_FORUM_ACCESS,
+		"EVERYONE",
+	);
+	const modForum = parseEnum(
+		formData.get("modForum"),
+		GUILD_MOD_ACCESS,
+		"ADMINS",
+	);
 
 	await db
 		.update(Guilds)

src/app/admin/page.tsx

@@ -13,6 +13,7 @@ import Link from "@/components/link";
 import { unixNow } from "@/lib/bans";
 import { Ban, db, StaffActivities, User, WebsiteArticles } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
+import { logServerError } from "@/lib/server-log";
 
 type RankCount = { rank: number; count: number };
 
@@ -37,7 +38,9 @@ export default async function AdminDashboard() {
 		online = onlineRow[0]?.total ?? 0;
 		articles = articlesRow[0]?.total ?? 0;
 		bans = bansRow[0]?.total ?? 0;
-	} catch {}
+	} catch (error) {
+		logServerError("admin.dashboard_stats_failed", error);
+	}
 	const dbOk = users >= 0;
 
 	const rankGroups = await db

src/app/api/admin/import/clone/sync-all/route.ts

@@ -2,6 +2,7 @@ import { inArray } from "drizzle-orm";
 import { withAdmin } from "@/lib/api-handler";
 import { db, ItemsBase } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
+import { logServerError } from "@/lib/server-log";
 import { logAudit } from "@/lib/services/audit";
 import {
 	cloneSingleFurni,
@@ -50,7 +51,11 @@ export const POST = withAdmin(
 				const entries = await fetchSourceFurnidata(source.furnidataUrl);
 				const byClassname = new Map(entries.map((e) => [e.classname, e]));
 				sourceFurniDataMap.set(source.id, byClassname);
-			} catch {}
+			} catch (error) {
+				logServerError("clone-import.furnidata_prefetch_failed", error, {
+					source: source.id,
+				});
+			}
 		}
 
 		// Collect all missing items using pre-fetched data

src/app/api/admin/search/route.ts

@@ -1,4 +1,5 @@
 import { eq, like, or } from "drizzle-orm";
+import { NextResponse } from "next/server";
 import { withAdmin } from "@/lib/api-handler";
 import { apiOk } from "@/lib/api-response";
 import {
@@ -11,8 +12,9 @@ import {
 	WebsiteShopArticles,
 } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
+import { rateLimit } from "@/lib/rate-limit";
 
-type SearchResult = {
+export type AdminSearchResult = {
 	type: string;
 	id: number | string;
 	title: string;
@@ -22,16 +24,36 @@ type SearchResult = {
 
 const PER_TYPE = 5;
 const MAX_TOTAL = 20;
+const MAX_QUERY_LENGTH = 64;
+
+/** Escape LIKE wildcards so user input can't widen the match. */
+export function escapeLike(input: string): string {
+	return input.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
 
 export const GET = withAdmin(
 	{ permission: PERMS.ADMIN_DASHBOARD },
-	async (request) => {
-		const q = (request.nextUrl.searchParams.get("q") || "").trim();
+	async (request, context) => {
+		const limited = await rateLimit(
+			`admin-search:${context.session.user.id}`,
+			30,
+			60_000,
+		);
+		if (!limited.ok) {
+			return NextResponse.json(
+				{ ok: false, error: "Too many requests" },
+				{ status: 429, headers: { "retry-after": String(limited.retryAfter) } },
+			);
+		}
+
+		const q = (request.nextUrl.searchParams.get("q") || "")
+			.trim()
+			.slice(0, MAX_QUERY_LENGTH);
 		if (q.length < 2) {
 			return apiOk({ results: [] });
 		}
 
-		const pattern = `%${q}%`;
+		const pattern = `%${escapeLike(q)}%`;
 		const idExact = Number.parseInt(q, 10);
 		const hasId = Number.isFinite(idExact) && String(idExact) === q;
 
@@ -131,7 +153,7 @@ export const GET = withAdmin(
 
 		const groupMap: Record<
 			string,
-			{ type: string; items: Array<SearchResult> }
+			{ type: string; items: Array<AdminSearchResult> }
 		> = {
 			users: { type: "users", items: [] },
 			articles: { type: "articles", items: [] },
@@ -196,7 +218,7 @@ export const GET = withAdmin(
 			});
 		}
 
-		const results: SearchResult[] = [];
+		const results: AdminSearchResult[] = [];
 		const order = [
 			"users",
 			"articles",
@@ -205,12 +227,19 @@ export const GET = withAdmin(
 			"shop",
 			"rareValues",
 		];
-		for (const key of order) {
-			for (const item of groupMap[key].items) {
-				results.push(item);
+		// Round-robin so no single type starves the others when capped.
+		for (let i = 0; results.length < MAX_TOTAL; i++) {
+			let added = false;
+			for (const key of order) {
+				const item = groupMap[key]?.items[i];
+				if (item && results.length < MAX_TOTAL) {
+					results.push(item);
+					added = true;
+				}
 			}
+			if (!added) break;
 		}
 
-		return apiOk({ results: results.slice(0, MAX_TOTAL) });
+		return apiOk({ results });
 	},
 );

src/components/admin/search-dialog.tsx

@@ -4,6 +4,7 @@ import { SearchIcon } from "lucide-react";
 import { useRouter } from "next/navigation";
 import { useTranslations } from "next-intl";
 import { useCallback, useEffect, useRef, useState } from "react";
+import type { AdminSearchResult } from "@/app/api/admin/search/route";
 import {
 	Command,
 	CommandEmpty,
@@ -15,13 +16,7 @@ import {
 import { Dialog, DialogContent } from "@/components/ui/dialog";
 import { useDebounce } from "@/hooks/use-debounce";
 
-type SearchResult = {
-	type: string;
-	id: number | string;
-	title: string;
-	subtitle: string;
-	url: string;
-};
+type SearchResult = AdminSearchResult;
 
 type SearchResponse = {
 	ok: boolean;
@@ -61,16 +56,26 @@ export function SearchDialog() {
 			const res = await fetch(`/api/admin/search?q=${encodeURIComponent(q)}`, {
 				signal: controller.signal,
 			});
+			if (!res.ok) return;
 			const data: SearchResponse = await res.json();
+			if (abortRef.current !== controller) return;
 			if (data.ok) setResults(data.results);
-		} catch {}
-		setLoading(false);
+		} catch (error) {
+			if (error instanceof DOMException && error.name === "AbortError") return;
+			if (abortRef.current === controller) setResults([]);
+		} finally {
+			if (abortRef.current === controller) setLoading(false);
+		}
 	}, []);
 
 	useEffect(() => {
 		fetchResults(debouncedQuery);
 	}, [debouncedQuery, fetchResults]);
 
+	useEffect(() => {
+		return () => abortRef.current?.abort();
+	}, []);
+
 	useEffect(() => {
 		function handleKeyDown(e: KeyboardEvent) {
 			if ((e.metaKey || e.ctrlKey) && e.key === "k") {

src/components/mobile-nav.tsx

@@ -6,6 +6,7 @@ import {
 	type ReactNode,
 	useCallback,
 	useEffect,
+	useId,
 	useRef,
 	useState,
 } from "react";
@@ -27,13 +28,15 @@ export function MobileNav({
 	const [open, setOpen] = useState(false);
 	const detailsRef = useRef<HTMLDivElement>(null);
 	const menuRef = useRef<HTMLDivElement>(null);
-	const MENU_ID = "mobile-nav-menu";
+	const toggleRef = useRef<HTMLButtonElement>(null);
+	const prevFocusRef = useRef<HTMLElement | null>(null);
+	const menuId = useId();
 
 	const handleEscape = useCallback(
 		(e: KeyboardEvent) => {
 			if (e.key === "Escape" && open) {
 				setOpen(false);
-				detailsRef.current?.querySelector<HTMLButtonElement>("button")?.focus();
+				(prevFocusRef.current ?? toggleRef.current)?.focus();
 			}
 		},
 		[open],
@@ -44,6 +47,38 @@ export function MobileNav({
 		return () => document.removeEventListener("keydown", handleEscape);
 	}, [handleEscape]);
 
+	// Initial focus, scroll-lock, click-outside close, focus restore.
+	useEffect(() => {
+		if (!open) return;
+		prevFocusRef.current =
+			document.activeElement instanceof HTMLElement
+				? document.activeElement
+				: null;
+		menuRef.current
+			?.querySelector<HTMLElement>(
+				'a[href], button:not([disabled]), [tabindex]:not([tabindex="-1"])',
+			)
+			?.focus();
+		const prevOverflow = document.body.style.overflow;
+		document.body.style.overflow = "hidden";
+
+		function handlePointerDown(e: PointerEvent) {
+			if (
+				menuRef.current &&
+				!menuRef.current.contains(e.target as Node) &&
+				!toggleRef.current?.contains(e.target as Node)
+			) {
+				setOpen(false);
+			}
+		}
+		document.addEventListener("pointerdown", handlePointerDown);
+		return () => {
+			document.body.style.overflow = prevOverflow;
+			document.removeEventListener("pointerdown", handlePointerDown);
+			(prevFocusRef.current ?? toggleRef.current)?.focus();
+		};
+	}, [open]);
+
 	useEffect(() => {
 		if (!open) return;
 		const menu = menuRef.current;
@@ -81,6 +116,7 @@ export function MobileNav({
 	return (
 		<div ref={detailsRef} className="group relative md:hidden">
 			<button
+				ref={toggleRef}
 				type="button"
 				onClick={() => setOpen((o) => !o)}
 				className="list-none cursor-pointer flex items-center justify-center w-11 h-11 rounded-xl shrink-0
@@ -90,8 +126,8 @@ export function MobileNav({
 					focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[var(--color-primary-readable,var(--color-primary))] focus-visible:ring-offset-2 focus-visible:ring-offset-[var(--color-navbar)]"
 				aria-label={open ? closeLabel : menuLabel}
 				aria-expanded={open}
-				aria-haspopup="true"
-				aria-controls={MENU_ID}
+				aria-haspopup="dialog"
+				aria-controls={menuId}
 			>
 				<motion.svg
 					className="w-6 h-6"
@@ -122,8 +158,9 @@ export function MobileNav({
 			<AnimatePresence>
 				{open && (
 					<motion.div
-						id={MENU_ID}
-						role="menu"
+						id={menuId}
+						role="dialog"
+						aria-modal="true"
 						aria-label={brandLabel || "Navigation menu"}
 						className="absolute left-0 top-full mt-2 w-[min(88vw,360px)] z-50 origin-top-left"
 						style={{ backgroundColor: "transparent" }}

src/components/navigation.tsx

@@ -11,6 +11,7 @@ import { ThemeSwitcher } from "@/components/theme-switcher";
 import { db, MessengerFriendrequests, MessengerOffline } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { canAccess, getApiAdminContext, PERMS } from "@/lib/permissions";
+import { logServerError } from "@/lib/server-log";
 
 export async function Navigation({ session }: { session: Session | null }) {
 	const t = await getTranslations("nav");
@@ -58,7 +59,11 @@ export async function Navigation({ session }: { session: Session | null }) {
 			]);
 			unreadMessages = unreadRows[0]?.total ?? 0;
 			pendingFriendRequests = pendingRows[0]?.total ?? 0;
-		} catch {}
+		} catch (error) {
+			logServerError("navigation.messenger_counts_failed", error, {
+				userId: id,
+			});
+		}
 	}
 
 	return (

src/components/top-header.tsx

@@ -17,6 +17,7 @@ import {
 } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { canAccess, getApiAdminContext, PERMS } from "@/lib/permissions";
+import { logServerError } from "@/lib/server-log";
 
 function Currency({
 	icon,
@@ -76,7 +77,9 @@ export async function TopHeader({ session }: { session: Session | null }) {
 			if (c.type === 0) duckets = c.amount;
 			if (c.type === 5) diamonds = c.amount;
 		}
-	} catch {}
+	} catch (error) {
+		logServerError("top-header.wallet_failed", error, { userId: id });
+	}
 
 	let showAdmin = false;
 	let showMod = false;
@@ -111,7 +114,8 @@ export async function TopHeader({ session }: { session: Session | null }) {
 				.where(eq(User.online, "1"));
 			return row?.total ?? 0;
 		});
-	} catch {
+	} catch (error) {
+		logServerError("top-header.online_count_failed", error);
 		online = 0;
 	}
 
@@ -130,7 +134,9 @@ export async function TopHeader({ session }: { session: Session | null }) {
 		]);
 		unreadMessages = unreadRows[0]?.total ?? 0;
 		pendingFriendRequests = pendingRows[0]?.total ?? 0;
-	} catch {}
+	} catch (error) {
+		logServerError("top-header.messenger_counts_failed", error, { userId: id });
+	}
 
 	const friendRequests = await db
 		.select({ userFromId: MessengerFriendrequests.userFromId })

src/lib/deploy-workflow-contract.test.ts

@@ -45,6 +45,7 @@ describe("deploy job", () => {
 
 	it("runs container with production env and volumes", () => {
 		expect(deployJob).toContain(". /var/www/atom-nexst/.env");
+		// biome-ignore lint/suspicious/noTemplateCurlyInString: intentional literal shell snippet
 		expect(deployJob).toContain('"${ENV_ARGS[@]}"');
 		expect(deployJob).toContain("/var/www/Gamedata:/var/www/Gamedata");
 		expect(deployJob).toContain("/app/storage");

src/lib/sanitize.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { sanitize } from "./sanitize";
+
+describe("sanitize", () => {
+	it("returns empty string for nullish input", () => {
+		expect(sanitize(null)).toBe("");
+		expect(sanitize(undefined)).toBe("");
+		expect(sanitize("")).toBe("");
+	});
+
+	it("keeps safe formatting tags", () => {
+		const out = sanitize("<p>Hello <strong>world</strong></p>");
+		expect(out).toContain("<strong>world</strong>");
+	});
+
+	it("strips event handlers", () => {
+		const out = sanitize('<img src="x.gif" onerror="alert(1)">');
+		expect(out).not.toContain("onerror");
+	});
+
+	it("strips javascript: URLs", () => {
+		const out = sanitize('<a href="javascript:alert(1)">click</a>');
+		expect(out).not.toContain("javascript:");
+	});
+
+	it("strips svg onload vectors", () => {
+		const out = sanitize('<svg onload="alert(1)"><circle r="10"/></svg>');
+		expect(out).not.toContain("onload");
+		expect(out).not.toContain("<svg");
+	});
+
+	it("strips script tags", () => {
+		const out = sanitize("<p>hi</p><script>alert(1)</script>");
+		expect(out).not.toContain("<script");
+		expect(out).toContain("hi");
+	});
+});

src/lib/sanitize.ts

@@ -1,6 +1,52 @@
 import DOMPurify from "isomorphic-dompurify";
 
+const ALLOWED_TAGS = [
+	"a",
+	"b",
+	"blockquote",
+	"br",
+	"code",
+	"em",
+	"h1",
+	"h2",
+	"h3",
+	"h4",
+	"hr",
+	"i",
+	"img",
+	"li",
+	"ol",
+	"p",
+	"pre",
+	"strong",
+	"table",
+	"tbody",
+	"td",
+	"th",
+	"thead",
+	"tr",
+	"u",
+	"ul",
+];
+
+const ALLOWED_ATTR = [
+	"href",
+	"src",
+	"alt",
+	"title",
+	"target",
+	"rel",
+	"colspan",
+	"rowspan",
+];
+
 export function sanitize(html: string | null | undefined): string {
 	if (!html) return "";
-	return DOMPurify.sanitize(html);
+	return DOMPurify.sanitize(html, {
+		ALLOWED_TAGS,
+		ALLOWED_ATTR,
+		ALLOW_DATA_ATTR: false,
+		FORBID_TAGS: ["style", "script", "svg", "math", "form", "input", "button"],
+		USE_PROFILES: { html: true },
+	});
 }