improvement: Call DomPurify.addHook only if it exists (#5428)
On server-side execution `dompurify` exports factory function instead of a purifier instance. Because of this, server-side code that imports SwaggerUI (e.g. via `swagger-ui-react`) fails, since `DomPurify.addHook` does not exist. This affects universal rendering apps which share code between client-side and server-side.
This commit is contained in:
@@ -5,16 +5,18 @@ import { linkify } from "remarkable/linkify"
|
||||
import DomPurify from "dompurify"
|
||||
import cx from "classnames"
|
||||
|
||||
DomPurify.addHook("beforeSanitizeElements", function (current, ) {
|
||||
// Attach safe `rel` values to all elements that contain an `href`,
|
||||
// i.e. all anchors that are links.
|
||||
// We _could_ just look for elements that have a non-self target,
|
||||
// but applying it more broadly shouldn't hurt anything, and is safer.
|
||||
if (current.href) {
|
||||
current.setAttribute("rel", "noopener noreferrer")
|
||||
}
|
||||
return current
|
||||
})
|
||||
if (DomPurify.addHook) {
|
||||
DomPurify.addHook("beforeSanitizeElements", function (current, ) {
|
||||
// Attach safe `rel` values to all elements that contain an `href`,
|
||||
// i.e. all anchors that are links.
|
||||
// We _could_ just look for elements that have a non-self target,
|
||||
// but applying it more broadly shouldn't hurt anything, and is safer.
|
||||
if (current.href) {
|
||||
current.setAttribute("rel", "noopener noreferrer")
|
||||
}
|
||||
return current
|
||||
})
|
||||
}
|
||||
|
||||
function Markdown({ source, className = "", getConfigs }) {
|
||||
if (typeof source !== "string") {
|
||||
|
||||
Reference in New Issue
Block a user