Merge pull request #790 from mukilane/main

fix: ensure ALLOWED_URI_REGEXP is reset
cure53 · Apr 13, 2023 · 7fa8b97 · 7fa8b97
2 parents dcb9ebe + 1c63c4b
commit 7fa8b97
Show file tree

Hide file tree

Showing 10 changed files with 36 additions and 18 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -479,7 +479,7 @@ function createDOMPurify(window = getGlobal()) {
     SANITIZE_NAMED_PROPS = cfg.SANITIZE_NAMED_PROPS || false; // Default false
     KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
     IN_PLACE = cfg.IN_PLACE || false; // Default false
-    IS_ALLOWED_URI = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
+    IS_ALLOWED_URI = cfg.ALLOWED_URI_REGEXP || EXPRESSIONS.IS_ALLOWED_URI;
     NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
     CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {};
     if (

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -1416,6 +1416,21 @@
         assert.equal(str, test.expected);
       });
     });
+    QUnit.test('Ensure ALLOWED_URI_REGEXP is not cached', function(assert) {
+      const 
+        dirty = '<img src="https://different.com">',
+        expected = '<img src="https://different.com">';
+
+      assert.equal(DOMPurify.sanitize(dirty), expected);
+
+      // sanitize with a custom URI regexp
+      assert.equal(DOMPurify.sanitize('<img src="https://test.com">', {
+        ALLOWED_URI_REGEXP: /test\.com/i
+      }), '<img src="https://test.com">');
+
+      // ensure that the previous regexp does not affect future santize calls
+      assert.equal(DOMPurify.sanitize(dirty), expected);
+    });
     QUnit.test(
       'Avoid freeze when using tables and ALLOW_TAGS',
       function (assert) {
@@ -2059,6 +2074,9 @@
       // set the same hook
       DOMPurify.addHook(entryPoint, hookFunction);
       assert.equal(DOMPurify.sanitize(dirty), expected);
+
+      // cleanup hook
+      DOMPurify.removeHook(entryPoint);
     });
   };
 });