Skip to content

feat: use new Sanitizer API & ditch stripScripts()#496

Merged
ghiscoding merged 1 commit into
mainfrom
feat/sanitizer-api
May 14, 2026
Merged

feat: use new Sanitizer API & ditch stripScripts()#496
ghiscoding merged 1 commit into
mainfrom
feat/sanitizer-api

Conversation

@ghiscoding
Copy link
Copy Markdown
Owner

closes #495

  1. remove stripScripts()
  2. use the new Sanitizer API when available as default sanitizer (user can still override it with for example DOMPurify)

@github-actions
Copy link
Copy Markdown

Playwright E2E Test Results

92 tests  ±0   92 ✅ ±0   2m 31s ⏱️ +19s
75 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit deac631. ± Comparison against base commit 3866ea7.

This pull request removes 1 and adds 1 tests. Note that renamed tests count towards both.
options32.spec.ts ‑ Options 32 - Sanitizer › select shows image not found and JS alert should be sanitized and not trigger
options32.spec.ts ‑ Options 32 - Sanitizer › select last 2 options should not trigger any alert(XSS)

@ghiscoding ghiscoding merged commit fa8406f into main May 14, 2026
4 checks passed
@ghiscoding ghiscoding deleted the feat/sanitizer-api branch May 14, 2026 02:23
@github-actions
Copy link
Copy Markdown

🎉 This pull request is included in version 5.2.0 📦
🔗 The release notes are available at: GitHub Release 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Potential XSS when HTML rendering is enabled without a reliable sanitizer

1 participant