fix: Avoid TypeError for null values on CUSTOM_ELEMENT_HANDLING config.

ISSUE-897
cure53 · Jan 5, 2024 · 38e4dc3 · 38e4dc3
1 parent 771eb82
commit 38e4dc3
Show file tree

Hide file tree

Showing 10 changed files with 28 additions and 9 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -139,7 +139,7 @@ function clone(object) {
     if (getOwnPropertyDescriptor(object, property) !== undefined) {
       if (Array.isArray(value)) {
         newObject[property] = cleanArray(value);
-      } else if (typeof value === 'object' && value.constructor === Object) {
+      } else if (value && typeof value === 'object' && value.constructor === Object) {
         newObject[property] = clone(value);
       } else {
         newObject[property] = value;

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/utils.js b/src/utils.js
@@ -136,7 +136,11 @@ function clone(object) {
     if (getOwnPropertyDescriptor(object, property) !== undefined) {
       if (Array.isArray(value)) {
         newObject[property] = cleanArray(value);
-      } else if (typeof value === 'object' && value.constructor === Object) {
+      } else if (
+        value &&
+        typeof value === 'object' &&
+        value.constructor === Object
+      ) {
         newObject[property] = clone(value);
       } else {
         newObject[property] = value;

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -804,6 +804,21 @@
         );
       }
     );
+    QUnit.test(
+      'CUSTOM_ELEMENT_HANDLING config values of null do not throw a TypeError.',
+      function (assert) {
+        DOMPurify.sanitize('', {
+          CUSTOM_ELEMENT_HANDLING: {
+            tagNameCheck: null,
+            attributeNameCheck: null,
+            allowCustomizedBuiltInElements: null,
+          },
+        });
+
+        // Don't see a great way to assert NOT throws...
+        assert.ok(true);
+      }
+    );
     QUnit.test('Test dirty being an array', function (assert) {
       assert.equal(
         DOMPurify.sanitize(['<a>123<b>456</b></a>']),