From 191cc0022e496875c40b598acfd988b46112c6b9 Mon Sep 17 00:00:00 2001 From: Tobias Smolka Date: Mon, 19 Dec 2022 16:58:55 +0100 Subject: [PATCH 1/2] Fix Trusted Types Sink violation with empty input and NAMESPACE --- src/purify.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/purify.js b/src/purify.js index c322fd6b..613f955b 100644 --- a/src/purify.js +++ b/src/purify.js @@ -844,7 +844,7 @@ function createDOMPurify(window = getGlobal()) { if (!doc || !doc.documentElement) { doc = implementation.createDocument(NAMESPACE, 'template', null); try { - doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload; + doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload; } catch (_) { // Syntax error if dirtyPayload is invalid xml } From 7de86a0719bc7b13e2f398fa13a070ec7a17ff6b Mon Sep 17 00:00:00 2001 From: Tobias Smolka Date: Mon, 19 Dec 2022 17:05:17 +0100 Subject: [PATCH 2/2] Fix formatting --- src/purify.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/purify.js b/src/purify.js index 613f955b..d0ba6669 100644 --- a/src/purify.js +++ b/src/purify.js @@ -844,7 +844,9 @@ function createDOMPurify(window = getGlobal()) { if (!doc || !doc.documentElement) { doc = implementation.createDocument(NAMESPACE, 'template', null); try { - doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload; + doc.documentElement.innerHTML = IS_EMPTY_INPUT + ? emptyHTML + : dirtyPayload; } catch (_) { // Syntax error if dirtyPayload is invalid xml }