RS-22753: Allowlist Font Awesome CDN link in Box sanitiser

[chschan]

Summary

RS-22478 added theSrc/scripts/sanitizeHtml.js, which sanitises as_html Box content through DOMPurify and strips <link>. That silently broke the documented Font Awesome icon pattern taught in the Displayr help centre (articles 360004283115 and "Adding Icons to Dashboards Using Font Awesome"):

'<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.2.0/css/all.css" ...>'
'<font color="red" style="font-size: 50pt"><i class="fas fa-arrow-down"></i></font>'

The <i class="fas …"> classes survive, but render blank because the CDN stylesheet/webfont that draws the glyphs — loaded by the stripped <link> — never arrives.

This PR restores that pattern without re-opening arbitrary external stylesheets.

Change

Extract <link> tags before DOMPurify (mirroring the existing <style> handling in sanitizeHtml.js) and re-insert only links that are:

• rel="stylesheet", and
• over https:, and
• to an exact-match allowlisted host (use.fontawesome.com).

Each kept link is rebuilt from scratch, preserving only rel/href/integrity/crossorigin — so onload/other attributes can't ride along, and outerHTML escaping prevents attribute-injection breakout. The allowlist is the STYLESHEET_HOST_ALLOWLIST constant (extend by adding hosts).

Why host-scope <link> (and not just re-allow it)

External CSS is a higher-risk vector than <img> (which Displayr already permits from arbitrary hosts per help article 360004368515): a stylesheet can exfiltrate page state via attribute-selector + background: url(...) tricks, whereas an image cannot. So <link> stays scoped to the Font Awesome CDN. integrity (SRI) is preserved, so even the allowlisted host can't serve tampered CSS.

No q/CSP change needed: /Dashboard emits no style-src/font-src/default-src, so the CDN stylesheet + webfont load once the sanitiser lets the <link> through.

Testing

node_modules/.bin/jest theSrc/scripts/sanitizeHtml.jest.test.js → 30/30 passing:

• Font Awesome CDN <link> survives with integrity/crossorigin preserved.
• Rejection guards: non-allowlisted host, look-alike suffix host (use.fontawesome.com.evil.com), non-stylesheet rel, http:, javascript:, onload stripped, case/whitespace normalised.
• Regression: the documented KPI flex-box and external-image-linking examples still survive intact (no collateral damage to <img>/<style>).

Notes

• The glyph renders on live dashboards (network permitting). Offline/exported reports would need Font Awesome bundled into the widget — deferred as a separate follow-up, out of scope here.
• Published reports keep their frozen bundle until re-rendered/recalculated; new calculations pick up the fix.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR restores support for the documented Font Awesome icon pattern in Box as_html content by allowing a tightly-scoped subset of <link rel="stylesheet"> tags to survive sanitization, without broadly reopening external stylesheet injection.

Changes:

• Added extraction and reinsertion of allowlisted HTTPS stylesheet <link> tags (exact host match) around the DOMPurify sanitization pass.
• Rebuilds kept <link> tags from scratch to preserve only rel, href, integrity, and crossorigin.
• Added Jest coverage for the allowlist behavior (positive case + rejection guards) and regression coverage for previously documented Box HTML/CSS patterns.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
theSrc/scripts/sanitizeHtml.js	Extracts <link> tags before DOMPurify and reinserts only HTTPS stylesheet links to an exact-match host allowlist, rebuilt with a minimal safe attribute set.
theSrc/scripts/sanitizeHtml.jest.test.js	Adds tests ensuring Font Awesome CDN links survive with SRI/CORS preserved, and that non-allowlisted/unsafe <link> variants are rejected; includes regression checks for documented Box features.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kevin-huang-displayr]

LGTM