refactor: use given HTML config for DOMPurify

2026-03-05 13:30:32 -05:00 · 2025-11-15 09:57:39 +00:00
parent f6893d338b
commit ad55131831
1 changed files with 3 additions and 4 deletions
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -812,12 +812,11 @@ jQuery.PrivateBin = (function($) {

            if (containsHtml) {
                // only allow tags/attributes we actually use in translations
-                output = DOMPurify.sanitize(
-                    output, {
+                const sanitizeConfig = Object.assign({}, purifyHtmlConfig, {
                        ALLOWED_TAGS: ['a', 'i', 'span', 'kbd'],
                        ALLOWED_ATTR: ['href', 'id']
-                    }
-                );
+                });
+                output = DOMPurify.sanitize(output, sanitizeConfig);
            }

            // if $element is given, insert translation