Merge pull request #874 from vitalyavolyn/open-links-new-tab

dimdenGD · web-flow · commit ebf37b59d9d2 · 2024-07-13T14:39:47.000+03:00
Preserve target=_blank attribute when purifying (fix #793)
diff --git a/scripts/helpers.js b/scripts/helpers.js
@@ -384,7 +384,8 @@ function escapeHTML(unsafe) {
     if(typeof unsafe === 'undefined' || unsafe === null) {
         return '';
     }
-    return DOMPurify.sanitize(String(unsafe));
+
+    return DOMPurify.sanitize(String(unsafe), { ADD_ATTR: ['target'] });
 }
 
 function html(strings, ...values) {

Original file line number	Diff line number	Diff line change
`@@ -384,7 +384,8 @@ function escapeHTML(unsafe) {`
`384`	`384`	`if(typeof unsafe === 'undefined' \|\| unsafe === null) {`
`385`	`385`	`return '';`
`386`	`386`	`}`
`387`		`- return DOMPurify.sanitize(String(unsafe));`
	`387`	`+`
	`388`	`+ return DOMPurify.sanitize(String(unsafe), { ADD_ATTR: ['target'] });`
`388`	`389`	`}`
`389`	`390`
`390`	`391`	`function html(strings, ...values) {`