diff --git a/src/vs/base/browser/dom.ts b/src/vs/base/browser/dom.ts index cf9a2361247..b756f7b5bf4 100644 --- a/src/vs/base/browser/dom.ts +++ b/src/vs/base/browser/dom.ts @@ -1432,20 +1432,21 @@ export const basicMarkupHtmlTags = Object.freeze([ 'wbr', ]); +const defaultDomPurifyConfig = Object.freeze({ + ALLOWED_TAGS: ['a', 'button', 'blockquote', 'code', 'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'input', 'label', 'li', 'p', 'pre', 'select', 'small', 'span', 'strong', 'textarea', 'ul', 'ol'], + ALLOWED_ATTR: ['href', 'data-href', 'data-command', 'target', 'title', 'name', 'src', 'alt', 'class', 'id', 'role', 'tabindex', 'style', 'data-code', 'width', 'height', 'align', 'x-dispatch', 'required', 'checked', 'placeholder', 'type'], + RETURN_DOM: false, + RETURN_DOM_FRAGMENT: false, + RETURN_TRUSTED_TYPE: true +}); + /** * Sanitizes the given `value` and reset the given `node` with it. */ export function safeInnerHtml(node: HTMLElement, value: string): void { - const options: dompurify.Config = { - ALLOWED_TAGS: ['a', 'button', 'blockquote', 'code', 'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'input', 'label', 'li', 'p', 'pre', 'select', 'small', 'span', 'strong', 'textarea', 'ul', 'ol'], - ALLOWED_ATTR: ['href', 'data-href', 'data-command', 'target', 'title', 'name', 'src', 'alt', 'class', 'id', 'role', 'tabindex', 'style', 'data-code', 'width', 'height', 'align', 'x-dispatch', 'required', 'checked', 'placeholder', 'type'], - RETURN_DOM: false, - RETURN_DOM_FRAGMENT: false, - }; - const hook = hookDomPurifyHrefAndSrcSanitizer(defaultSafeProtocols); try { - const html = dompurify.sanitize(value, { ...options, RETURN_TRUSTED_TYPE: true }); + const html = dompurify.sanitize(value, defaultDomPurifyConfig); node.innerHTML = html as unknown as string; } finally { hook.dispose();