Merge branch 'master' into custom-forms-mjml

# Conflicts:
#	lib/tools.js
#	package.json

lib/tools.js

@@ -1,15 +1,17 @@
 'use strict';
 
+let fs = require('fs');
+let path = require('path');
 let db = require('./db');
 let slugify = require('slugify');
 let Isemail = require('isemail');
 let urllib = require('url');
 let juice = require('juice');
 let jsdom = require('jsdom');
+let he = require('he');
 let _ = require('./translate')._;
 let util = require('util');
-let fs = require('fs');
-let path = require('path');
+let createDOMPurify = require('dompurify');
 
 let blockedUsers = ['abuse', 'admin', 'billing', 'compliance', 'devnull', 'dns', 'ftp', 'hostmaster', 'inoc', 'ispfeedback', 'ispsupport', 'listrequest', 'list', 'maildaemon', 'noc', 'noreply', 'noreply', 'null', 'phish', 'phishing', 'postmaster', 'privacy', 'registrar', 'root', 'security', 'spam', 'support', 'sysadmin', 'tech', 'undisclosedrecipients', 'unsubscribe', 'usenet', 'uucp', 'webmaster', 'www'];
 
@@ -24,6 +26,7 @@ module.exports = {
     formatMessage,
     getMessageLinks,
     prepareHtml,
+    purifyHTML,
     mergeTemplateIntoLayout,
     workers: new Set()
 };
@@ -172,7 +175,7 @@ function getMessageLinks(serviceUrl, campaign, list, subscription) {
     };
 }
 
-function formatMessage(serviceUrl, campaign, list, subscription, message, filter) {
+function formatMessage(serviceUrl, campaign, list, subscription, message, filter, isHTML) {
     filter = typeof filter === 'function' ? filter : (str => str);
 
     let links = getMessageLinks(serviceUrl, campaign, list, subscription);
@@ -183,7 +186,9 @@ function formatMessage(serviceUrl, campaign, list, subscription, message, filter
             return links[key];
         }
         if (subscription.mergeTags.hasOwnProperty(key)) {
-            return subscription.mergeTags[key];
+            return isHTML ? he.encode(subscription.mergeTags[key], {
+                useNamedReferences: true
+            }) : subscription.mergeTags[key];
         }
         return false;
     };
@@ -199,8 +204,13 @@ function prepareHtml(html, callback) {
     if (!(html || '').toString().trim()) {
         return callback(null, false);
     }
-
-    jsdom.env(html, (err, win) => {
+    jsdom.env(false, false, {
+        html,
+        features: {
+            FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+            ProcessExternalResources: false // do not execute JS within script blocks
+        }
+    }, (err, win) => {
         if (err) {
             return callback(err);
         }
@@ -228,6 +238,17 @@ function prepareHtml(html, callback) {
     });
 }
 
+function purifyHTML(html) {
+    let win = jsdom.jsdom('', {
+        features: {
+            FetchExternalResources: false, // disables resource loading over HTTP / filesystem
+            ProcessExternalResources: false // do not execute JS within script blocks
+        }
+    }).defaultView;
+    let DOMPurify = createDOMPurify(win);
+    return DOMPurify.sanitize(html);
+}
+
 // TODO Simplify!
 function mergeTemplateIntoLayout(template, layout, callback) {
 
@@ -274,4 +295,4 @@ function mergeTemplateIntoLayout(template, layout, callback) {
     } else {
         return done(template, layout);
     }
-}
+}