|
1 | 1 | import DOMPurify from 'dompurify';
|
2 | 2 |
|
3 |
| -function getLinkAttr(node: Element, attr: string) { |
4 |
| - return (node.nodeName === 'A' && node.getAttribute(attr)) || ''; |
5 |
| -} |
6 |
| - |
7 |
| -// set `a` element owning target to `target=_blank` |
8 |
| -// https://github.com/cure53/DOMPurify/issues/317 |
9 | 3 | DOMPurify.addHook('beforeSanitizeAttributes', (node: Element) => {
|
10 |
| - if (getLinkAttr(node, 'target')) { |
11 |
| - node.setAttribute('rel', 'noopener'); |
| 4 | + if (node instanceof HTMLElement && node.hasAttribute('href')) { |
| 5 | + const href = node.getAttribute('href'); |
| 6 | + |
| 7 | + if (href) { |
| 8 | + node.dataset.cuiHref = href; |
| 9 | + } |
| 10 | + if (node.getAttribute('target') === '_blank') { |
| 11 | + node.dataset.cuiTarget = '1'; |
| 12 | + } |
12 | 13 | }
|
13 | 14 | });
|
14 | 15 |
|
15 | 16 | DOMPurify.addHook('afterSanitizeAttributes', (node: Element) => {
|
16 |
| - if (getLinkAttr(node, 'rel') === 'noopener') { |
17 |
| - node.setAttribute('target', '_blank'); |
| 17 | + if (node instanceof HTMLElement) { |
| 18 | + if (node.dataset.cuiHref && node.hasAttribute('href')) { |
| 19 | + node.removeAttribute('data-cui-href'); |
| 20 | + } |
| 21 | + if (node.dataset.cuiTarget) { |
| 22 | + node.setAttribute('target', '_blank'); |
| 23 | + node.setAttribute('rel', 'noopener noreferrer'); |
| 24 | + node.removeAttribute('data-cui-target'); |
| 25 | + } |
18 | 26 | }
|
19 | 27 | });
|
0 commit comments