feat(surveys): Add question html support

frontend/src/scenes/surveys/Survey.tsx

@@ -270,9 +270,10 @@ export function SurveyForm({ id }: { id: string }): JSX.Element {
                                                                         ?.toLowerCase()
                                                                         .includes('<script') && (
                                                                         <LemonBanner type="warning">
-                                                                            Scripts won't run in the survey popup. Use
-                                                                            the API question mode to run your own
-                                                                            scripts in surveys.
+                                                                            Scripts won't run in the survey popup and
+                                                                            we'll remove these on save. Use the API
+                                                                            question mode to run your own scripts in
+                                                                            surveys.
                                                                         </LemonBanner>
                                                                     )}
                                                             </>

frontend/src/scenes/surveys/surveyLogic.tsx

@@ -33,6 +33,7 @@ import {
     NEW_SURVEY,
     NewSurvey,
 } from './constants'
+import { sanitize } from 'dompurify'
 
 export interface SurveyLogicProps {
     id: string | 'new'
@@ -101,11 +102,11 @@ export const surveyLogic = kea<surveyLogicType>([
                 }
                 return { ...NEW_SURVEY }
             },
-            createSurvey: async (surveyPayload) => {
-                return await api.surveys.create(surveyPayload)
+            createSurvey: async (surveyPayload: Partial<Survey>) => {
+                return await api.surveys.create(sanitizeQuestions(surveyPayload))
             },
-            updateSurvey: async (surveyPayload) => {
-                return await api.surveys.update(props.id, surveyPayload)
+            updateSurvey: async (surveyPayload: Partial<Survey>) => {
+                return await api.surveys.update(props.id, sanitizeQuestions(surveyPayload))
             },
             launchSurvey: async () => {
                 const startDate = dayjs()
@@ -461,3 +462,19 @@ export const surveyLogic = kea<surveyLogicType>([
         }
     }),
 ])
+
+function sanitizeQuestions(surveyPayload: Partial<Survey>): Partial<Survey> {
+    if (!surveyPayload.questions) {
+        return surveyPayload
+    }
+    return {
+        ...surveyPayload,
+        questions: surveyPayload.questions?.map((rawQuestion) => {
+            return {
+                ...rawQuestion,
+                description: sanitize(rawQuestion.description || ''),
+                question: sanitize(rawQuestion.question || ''),
+            }
+        }),
+    }
+}

posthog/api/survey.py

@@ -26,6 +26,8 @@
 
 from posthog.utils_cors import cors_response
 
+import nh3
+
 SURVEY_TARGETING_FLAG_PREFIX = "survey-targeting-"
 
 
@@ -87,6 +89,36 @@ class Meta:
         ]
         read_only_fields = ["id", "linked_flag", "targeting_flag", "created_at"]
 
+    def validate_questions(self, value):
+        if value is None:
+            return value
+
+        if not isinstance(value, list):
+            raise serializers.ValidationError("Questions must be a list of objects")
+
+        cleaned_questions = []
+        for raw_question in value:
+            if not isinstance(raw_question, dict):
+                raise serializers.ValidationError("Questions must be a list of objects")
+
+            cleaned_question = {
+                **raw_question,
+            }
+            question_text = raw_question.get("question")
+
+            if not question_text:
+                raise serializers.ValidationError("Question text is required")
+
+            description = raw_question.get("description")
+            if nh3.is_html(question_text):
+                cleaned_question["question"] = nh3.clean(question_text)
+            if description and nh3.is_html(description):
+                cleaned_question["description"] = nh3.clean(description)
+
+            cleaned_questions.append(cleaned_question)
+
+        return cleaned_questions
+
     def validate(self, data):
         linked_flag_id = data.get("linked_flag_id")
         if linked_flag_id:

posthog/api/test/test_survey.py

@@ -640,6 +640,163 @@ def test_updating_survey_name_validates(self):
         )
 
 
+class TestSurveyQuestionValidation(APIBaseTest):
+    def test_create_basic_survey_question_validation(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": [
+                    {"type": "open", "question": "What up?", "description": "<script>alert(0)</script>check?"},
+                    {
+                        "type": "link",
+                        "link": "bazinga.com",
+                        "question": "<b>What</b> do you think of the new notebooks feature?",
+                    },
+                ],
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_201_CREATED, response_data
+        assert Survey.objects.filter(id=response_data["id"]).exists()
+        assert response_data["name"] == "Notebooks beta release survey"
+        assert response_data["description"] == "Get feedback on the new notebooks feature"
+        assert response_data["type"] == "popover"
+        assert response_data["questions"] == [
+            {"type": "open", "question": "What up?", "description": "check?"},
+            {
+                "type": "link",
+                "link": "bazinga.com",
+                "question": "<b>What</b> do you think of the new notebooks feature?",
+            },
+        ]
+        assert response_data["created_by"]["id"] == self.user.id
+
+    def test_update_basic_survey_question_validation(self):
+
+        basic_survey = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "survey without targeting",
+                "type": "popover",
+            },
+            format="json",
+        ).json()
+
+        response = self.client.patch(
+            f"/api/projects/{self.team.id}/surveys/{basic_survey['id']}/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": [
+                    {"type": "open", "question": "What up?", "description": "<script>alert(0)</script>check?"},
+                    {
+                        "type": "link",
+                        "link": "bazinga.com",
+                        "question": "<b>What</b> do you think of the new notebooks feature?",
+                    },
+                ],
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_200_OK, response_data
+        assert Survey.objects.filter(id=response_data["id"]).exists()
+        assert response_data["name"] == "Notebooks beta release survey"
+        assert response_data["description"] == "Get feedback on the new notebooks feature"
+        assert response_data["type"] == "popover"
+        assert response_data["questions"] == [
+            {"type": "open", "question": "What up?", "description": "check?"},
+            {
+                "type": "link",
+                "link": "bazinga.com",
+                "question": "<b>What</b> do you think of the new notebooks feature?",
+            },
+        ]
+        assert response_data["created_by"]["id"] == self.user.id
+
+    def test_cleaning_empty_questions(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": [],
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_201_CREATED, response_data
+        assert Survey.objects.filter(id=response_data["id"]).exists()
+        assert response_data["name"] == "Notebooks beta release survey"
+        assert response_data["questions"] == []
+
+    def test_validate_question_with_missing_text(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": [{"type": "open"}],
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_400_BAD_REQUEST, response_data
+        assert response_data["detail"] == "Question text is required"
+
+    def test_validate_malformed_questions(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": "",
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_400_BAD_REQUEST, response_data
+        assert response_data["detail"] == "Questions must be a list of objects"
+
+    def test_validate_malformed_questions_as_string(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": "this is my question",
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_400_BAD_REQUEST, response_data
+        assert response_data["detail"] == "Questions must be a list of objects"
+
+    def test_validate_malformed_questions_as_array_of_strings(self):
+        response = self.client.post(
+            f"/api/projects/{self.team.id}/surveys/",
+            data={
+                "name": "Notebooks beta release survey",
+                "description": "Get feedback on the new notebooks feature",
+                "type": "popover",
+                "questions": ["this is my question"],
+            },
+            format="json",
+        )
+        response_data = response.json()
+        assert response.status_code == status.HTTP_400_BAD_REQUEST, response_data
+        assert response_data["detail"] == "Questions must be a list of objects"
+
+
 class TestSurveysAPIList(BaseTest, QueryMatchingTest):
     def setUp(self):
         cache.clear()

posthog/models/feature_flag/flag_matching.py

@@ -496,6 +496,7 @@ def hashed_identifier(self, feature_flag: FeatureFlag) -> Optional[str]:
                     return self.hash_key_overrides[feature_flag.key]
             return self.distinct_id
         else:
+            # TODO: Don't use the cache if self.groups is empty, since that means no groups provided anyway
             # :TRICKY: If aggregating by groups
             group_type_name = self.cache.group_type_index_to_name.get(feature_flag.aggregation_group_type_index)
             group_key = self.groups.get(group_type_name)  # type: ignore

requirements.in

@@ -86,3 +86,4 @@ more-itertools==9.0.0
 django-two-factor-auth==1.14.0
 phonenumberslite==8.13.6
 openai==0.27.8
+nh3==0.2.14

requirements.txt

@@ -301,6 +301,8 @@ multidict==6.0.2
     #   yarl
 mypy-boto3-s3==1.26.127
     # via boto3-stubs
+nh3==0.2.14
+    # via -r requirements.in
 numpy==1.23.3
     # via
     #   -r requirements.in