From 964dc36a126cc6dafef5ea017a4c9806f5bce303 Mon Sep 17 00:00:00 2001
From: Julien Droulez <julien.droulez@learningplanetinstitute.org>
Date: Fri, 7 Nov 2025 12:07:31 +0100
Subject: [PATCH] fix: filter out fordbidden tags in html editors

---
 .../base/form/TextEditor/useTipTap.js         | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/components/base/form/TextEditor/useTipTap.js b/src/components/base/form/TextEditor/useTipTap.js
index 26b91362..c32b3c12 100644
--- a/src/components/base/form/TextEditor/useTipTap.js
+++ b/src/components/base/form/TextEditor/useTipTap.js
@@ -56,8 +56,27 @@ export function useTipTap({ props, emit, t }) {
   const toaster = useToasterStore()
   const organizationsStore = useOrganizationsStore()
 
+  const filteredTags = computed(() => {
+    const forbiddenTags = [/<script.*?<\/script>/gim]
+    if (props.mode != 'full') {
+      forbiddenTags.push(/<iframe.*?<\/iframe>/gim)
+      forbiddenTags.push(/<video.*?<\/video>/gim)
+      forbiddenTags.push(/<video.*?>/gim)
+      forbiddenTags.push(/<img.*?>/gim)
+    }
+    return forbiddenTags
+  })
+
   const onUpdate = ({ editor }) => {
-    emit('update:modelValue', editor.getHTML())
+    let html = editor.getHTML()
+    let filteredHtml = html
+    filteredTags.value?.forEach((re) => {
+      filteredHtml = filteredHtml.replaceAll(re, '')
+    })
+    if (html != filteredHtml) {
+      editor.commands.setContent(filteredHtml)
+    }
+    emit('update:modelValue', filteredHtml)
   }
 
   const onBlur = (e) => {