Always include default config for DOMPurify

This fixes a bug which incorrectly overrides the
default config when passed with another config.

Changelog: security

app/assets/javascripts/lib/dompurify.js

@@ -52,4 +52,4 @@ addHook('afterSanitizeAttributes', (node) => {
   }
 });
 
-export const sanitize = (val, config = defaultConfig) => dompurifySanitize(val, config);
+export const sanitize = (val, config) => dompurifySanitize(val, { ...defaultConfig, ...config });

spec/frontend/lib/dompurify_spec.js

@@ -44,6 +44,19 @@ describe('~/lib/dompurify', () => {
     expect(sanitize('<strong></strong>', { ALLOWED_TAGS: [] })).toBe('');
   });
 
+  describe('includes default configuration', () => {
+    it('with empty config', () => {
+      const svgIcon = '<svg width="100"><use></use></svg>';
+      expect(sanitize(svgIcon, {})).toBe(svgIcon);
+    });
+
+    it('with valid config', () => {
+      expect(sanitize('<a href="#" data-remote="true"></a>', { ALLOWED_TAGS: ['a'] })).toBe(
+        '<a href="#"></a>',
+      );
+    });
+  });
+
   describe.each`
     type          | gon
     ${'root'}     | ${rootGon}