whitelist rdfa tags/attrs in html sanitizer
This commit is contained in:
@@ -8,6 +8,9 @@ export function sanitize_html(html: string, custom_elements?: CustomElementHandl
|
||||
const { window } = new JSDOM('');
|
||||
const dom_purify = createDOMPurify(window as any as Window);
|
||||
return dom_purify.sanitize(html, {
|
||||
CUSTOM_ELEMENT_HANDLING: custom_elements
|
||||
CUSTOM_ELEMENT_HANDLING: custom_elements,
|
||||
ALLOWED_TAGS: ['meta'],
|
||||
ALLOWED_ATTR: ['typeof', 'property', 'content'],
|
||||
ADD_URI_SAFE_ATTR: ['typeof']
|
||||
});
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user