site-builder/craft/src/components/basic/HtmlBlock.tsx

import React, { CSSProperties, useMemo } from 'react';
import { useNode, UserComponent } from '@craftjs/core';
import DOMPurify from 'dompurify';

interface HtmlBlockProps {
  code: string;
  style?: CSSProperties;
  aiName?: string;
  node_id?: string;
}

const PURIFY_CONFIG = {
  ALLOWED_TAGS: [
    'a','p','br','hr','div','span','section','article',
    'header','footer','main','aside','nav',
    'ul','ol','li',
    'h1','h2','h3','h4','h5','h6',
    'em','strong','b','i','u','s',
    'blockquote','code','pre',
    'img','figure','figcaption',
    'iframe',
  ],
  ALLOWED_ATTR: [
    'href','src','alt','title','target','rel',
    'width','height','class',
    'allowfullscreen','allow','frameborder',
    'sandbox','referrerpolicy',
  ],
  ALLOWED_URI_REGEXP: /^(?:(?:https?|mailto|tel|data:image\/[a-z]+;base64,):|[^a-z]|[a-z+.-]+(?:[^a-z+.\-:]|$))/i,
  FORBID_TAGS: ['script','style','object','embed','link','meta','form','input','button','select','textarea'],
  FORBID_ATTR: [/^on/i],
};

// M-6: `<iframe>` is allowed (maps/video embeds are a legitimate use case)
// but an iframe with a `src` and NO `sandbox` attribute is a clickjacking/
// phishing vector (DOMPurify already strips <script>/on*=, but an
// unsandboxed iframe still gets full script execution, same-origin-ish
// access via document.domain tricks, top-level navigation, etc., inside
// itself). This hook force-sets a restrictive sandbox on every iframe that
// survives sanitization, keeping `allow-scripts`/`allow-same-origin`/
// `allow-popups`/`allow-forms` (needed for interactive maps/video/oauth
// popups) but deliberately omitting `allow-top-navigation` so an embedded
// page can never redirect/hijack the parent tab.
const IFRAME_SANDBOX_HOOK = (node: Element): void => {
  if (node.nodeName === 'IFRAME') {
    node.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups allow-forms');
    node.setAttribute('referrerpolicy', 'no-referrer');
  }
};

export function purifyHtml(input: string): string {
  // Hook is added immediately before sanitize() and removed immediately
  // after, scoped tightly to this single call -- so it can never leak onto
  // (or accumulate duplicate copies across) any other DOMPurify.sanitize()
  // call elsewhere in the app, and repeated purifyHtml() calls never stack
  // multiple copies of the same hook.
  DOMPurify.addHook('afterSanitizeAttributes', IFRAME_SANDBOX_HOOK);
  try {
    return DOMPurify.sanitize(input || '', PURIFY_CONFIG as any) as unknown as string;
  } finally {
    DOMPurify.removeHook('afterSanitizeAttributes', IFRAME_SANDBOX_HOOK as any);
  }
}

export const HtmlBlock: UserComponent<HtmlBlockProps> = ({ code = '', style = {} }) => {
  const { connectors: { connect, drag }, selected } = useNode((node) => ({ selected: node.events.selected }));
  const clean = useMemo(() => purifyHtml(code), [code]);
  const setRef = (ref: HTMLElement | null): void => { if (ref) connect(drag(ref)); };
  return React.createElement('div', {
    ref: setRef,
    style: {
      minHeight: '40px',
      outline: selected ? '2px solid #3b82f6' : 'none',
      ...style,
    },
    dangerouslySetInnerHTML: { __html: clean },
  });
};

/* ---------- Craft config ---------- */

HtmlBlock.craft = {
  displayName: 'HTML',
  props: {
    code: '',
    style: {},
  },
  rules: {
    canDrag: () => true,
    canMoveIn: () => false,
    canMoveOut: () => true,
  },
};

/* ---------- HTML export ---------- */

(HtmlBlock as any).toHtml = (props: HtmlBlockProps, _childrenHtml: string) => {
  // Run through the same DOMPurify config used for the live editor preview
  // so exported pages can't carry <script>/on*= payloads either.
  return { html: purifyHtml(props.code || '') };
};