Commit 6434079d authored by Natalia Tepluhina's avatar Natalia Tepluhina

Merge branch 'djadmin-fix-dompurify-configuration' into 'master'

Prevent overriding DOMPurify's default config with custom configuration

See merge request gitlab-org/gitlab!69269
parents 23716539 de0647b6
......@@ -52,4 +52,4 @@ addHook('afterSanitizeAttributes', (node) => {
}
});
export const sanitize = (val, config = defaultConfig) => dompurifySanitize(val, config);
export const sanitize = (val, config) => dompurifySanitize(val, { ...defaultConfig, ...config });
......@@ -44,6 +44,19 @@ describe('~/lib/dompurify', () => {
expect(sanitize('<strong></strong>', { ALLOWED_TAGS: [] })).toBe('');
});
describe('includes default configuration', () => {
it('with empty config', () => {
const svgIcon = '<svg width="100"><use></use></svg>';
expect(sanitize(svgIcon, {})).toBe(svgIcon);
});
it('with valid config', () => {
expect(sanitize('<a href="#" data-remote="true"></a>', { ALLOWED_TAGS: ['a'] })).toBe(
'<a href="#"></a>',
);
});
});
describe.each`
type | gon
${'root'} | ${rootGon}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment