diff --git a/js/privatebin.js b/js/privatebin.js index c02767e2..f8a55cbe 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -812,12 +812,11 @@ jQuery.PrivateBin = (function($) { if (containsHtml) { // only allow tags/attributes we actually use in translations - output = DOMPurify.sanitize( - output, { + const sanitizeConfig = Object.assign({}, purifyHtmlConfig, { ALLOWED_TAGS: ['a', 'i', 'span', 'kbd'], ALLOWED_ATTR: ['href', 'id'] - } - ); + }); + output = DOMPurify.sanitize(output, sanitizeConfig); } // if $element is given, insert translation