TASK-8059 - Allow to export Report to a Word Document #1052
Conversation
…raphs. Added methods to parse CSS styles and apply them to Word document elements, including support for font properties, colors, and background styles. Updated existing methods to utilize new styling capabilities for titles, descriptions, and list items.
There was a problem hiding this comment.
Copilot reviewed 100 out of 176 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
src/webcomponents/file/file-delete.js:1
- Debugger statement should be removed before merging to production code.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| #htmlToPlainText(html) { | ||
| if (typeof html !== "string") { | ||
| return String(html ?? ""); | ||
| } | ||
| // Use DOMParser to strip HTML tags while keeping text content | ||
| const parser = new DOMParser(); | ||
| const doc = parser.parseFromString(html, "text/html"); | ||
| return doc.body.textContent || ""; | ||
| } |
There was a problem hiding this comment.
Using DOMParser with unsanitized HTML could be a security concern. Consider validating or sanitizing the HTML input before parsing to prevent potential XSS attacks.
| // Fetch remote image and embed | ||
| try { | ||
| const imageRun = await this.#remoteUrlToImageRun(src, child); |
There was a problem hiding this comment.
Fetching images from remote URLs without validation could pose security risks. Consider implementing URL validation or using a whitelist of allowed domains before fetching remote images.
| // Fetch remote image and embed | |
| try { | |
| const imageRun = await this.#remoteUrlToImageRun(src, child); | |
| // Validate and fetch remote image and embed | |
| try { | |
| const url = new URL(src, window.location?.origin || undefined); | |
| // Only allow http/https protocols | |
| if (url.protocol !== "http:" && url.protocol !== "https:") { | |
| throw new Error("Disallowed image URL protocol"); | |
| } | |
| // Optional hostname whitelist via wordConfig.allowedImageHosts | |
| const allowedHosts = this.wordConfig?.allowedImageHosts; | |
| if (Array.isArray(allowedHosts) && allowedHosts.length > 0 && !allowedHosts.includes(url.hostname)) { | |
| throw new Error("Disallowed image host"); | |
| } | |
| const imageRun = await this.#remoteUrlToImageRun(url.toString(), child); |
|
No description provided.