Merge pull request #748 from tosmolka/tosmolka/747

Fix Trusted Types Sink violation with empty input and NAMESPACE
cure53 · Dec 20, 2022 · 24d2a7f · 24d2a7f
2 parents 4945074 + 7de86a0
commit 24d2a7f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/purify.js b/src/purify.js
@@ -844,7 +844,9 @@ function createDOMPurify(window = getGlobal()) {
     if (!doc || !doc.documentElement) {
       doc = implementation.createDocument(NAMESPACE, 'template', null);
       try {
-        doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload;
+        doc.documentElement.innerHTML = IS_EMPTY_INPUT
+          ? emptyHTML
+          : dirtyPayload;
       } catch (_) {
         // Syntax error if dirtyPayload is invalid xml
       }