Skip to content

Commit 9095a99

Browse files
author
Fabien Quatravaux
committed
[fix #1467] Make sure target attribute is kept after DOMPurify sanitization
1 parent 60341ce commit 9095a99

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/core/render/index.js

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,10 @@ export function renderMixin(proto) {
330330
},
331331
tokens => {
332332
html = this.compiler.compile(tokens);
333-
html = this.isRemoteUrl ? DOMPurify.sanitize(html) : html;
333+
// add "target" attribute to DOMPurify white list to handle external links
334+
html = this.isRemoteUrl
335+
? DOMPurify.sanitize(html, { ADD_ATTR: ['target'] })
336+
: html;
334337
callback();
335338
next();
336339
}

0 commit comments

Comments
 (0)