Closed yam4office closed 5 months ago
Correct @realansgar , thanks :sweat_smile:
It gave the output as
\x3Cscript>a\x3C/script>
is that expected?
attached screenshot
Nope, this is what the result looks like:
DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script'], FORCE_BODY: true})
// "<script>a</script>"
\x3c
is the hex encoded <
character. So the string actually contains <script>
, it is just displayed differently by the Chrome console.
Today I learned: The Chrome console does this deliberately and only in very specific instances to enable devs to copy paste stuff from the console directly into an inline script in their HTML file without accidently breaking out of it (or inserting a comment).
Hi Team, For a particular use case I need to allow ',{ADD_TAGS:['script']},{FORCE_BODY: true})
DOMPurify.sanitize
takes a single config object with all options, not multiple objects.DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script'], FORCE_BODY: true})
should work instead.