feat(plugin-git): sanitize commit messages

plugins/development/plugin-git/package.json

@@ -40,6 +40,10 @@
     "@vuepress/helper": "workspace:*",
     "@vueuse/core": "catalog:",
     "execa": "^9.5.2",
+    "rehype-parse": "^9.0.1",
+    "rehype-sanitize": "^6.0.0",
+    "rehype-stringify": "^10.0.1",
+    "unified": "^11.0.5",
     "vue": "catalog:"
   },
   "peerDependencies": {

plugins/development/plugin-git/src/client/components/GitChangelog.ts

@@ -88,7 +88,7 @@ export const GitChangelog = defineComponent({
           [h('code', item.hash.slice(0, 5))],
         ),
         h('span', { class: 'vp-changelog-divider' }, '-'),
-        h('span', { class: 'vp-changelog-message' }, item.message),
+        h('span', { class: 'vp-changelog-message', innerHTML: item.message }),
         h('span', { 'class': 'vp-changelog-date', 'data-allow-mismatch': '' }, [
           locale.value.timeOn || 'on',
           ' ',

plugins/development/plugin-git/src/node/resolveChangelog.ts

@@ -5,6 +5,7 @@ import type { MergedRawCommit } from './typings.js'
 import {
   getContributorInfo,
   getUserNameWithNoreplyEmail,
+  sanitizeHTML,
 } from './utils/index.js'
 
 const RE_CLEAN_REFS = /[()]/g
@@ -44,7 +45,7 @@ export const resolveChangelog = (
       time,
       email: contributor?.email || email,
       author: contributor?.name ?? contributor?.username ?? author,
-      message: app.markdown.renderInline(message),
+      message: sanitizeHTML(app.markdown.renderInline(message)),
     }
 
     if (coAuthors.length) resolved.coAuthors = coAuthors

plugins/development/plugin-git/src/node/utils/index.ts

@@ -6,3 +6,4 @@ export * from './getUserNameWithNoreplyEmail.js'
 export * from './inferGitProvider.js'
 export * from './injectGitOptions.js'
 export * from './checkGithubUsername.js'
+export * from './sanitizeHTML.js'

plugins/development/plugin-git/src/node/utils/sanitizeHTML.ts

@@ -0,0 +1,27 @@
+import rehypeParse from 'rehype-parse'
+import rehypeSanitize, { defaultSchema } from 'rehype-sanitize'
+import rehypeStringify from 'rehype-stringify'
+import type { Processor } from 'unified'
+import { unified } from 'unified'
+
+let rehypeInstance: Processor | null = null
+
+/**
+ * Sanitize HTML
+ * @see https://github.com/rehypejs/rehype-sanitize
+ */
+export const sanitizeHTML = (html: string): string => {
+  rehypeInstance ??= unified()
+    .use(rehypeParse, { fragment: true })
+    .use(rehypeSanitize, {
+      ...defaultSchema,
+      attributes: {
+        ...defaultSchema.attributes,
+        a: [...(defaultSchema.attributes?.a ?? []), 'target', 'rel'],
+      },
+    })
+    .use(rehypeStringify)
+    .freeze() as unknown as Processor
+
+  return String(rehypeInstance.processSync(html))
+}