Question regarding DOMPurify ADD_TAGS is not allowing <script> tag about dompurify HOT 7 CLOSED

\x3c is the hex encoded < character. So the string actually contains <script>, it is just displayed differently by the Chrome console.

Today I learned: The Chrome console does this deliberately and only in very specific instances to enable devs to copy paste stuff from the console directly into an inline script in their HTML file without accidently breaking out of it (or inserting a comment).

from dompurify.

Heya, try to use the FORCE_BODY: true as config option, that should do the trick 🙂

from dompurify.

I tried both

DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script']},{FORCE_BODY: true})
and

DOMPurify.sanitize('<script>a</script>',{FORCE_BODY: true})
they gave empty string as result, added screenshot from demo page below:

from dompurify.

DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script']},{FORCE_BODY: true})

DOMPurify.sanitize takes a single config object with all options, not multiple objects.

DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script'], FORCE_BODY: true}) should work instead.

from dompurify.

Correct @realansgar , thanks 😅

from dompurify.

It gave the output as
\x3Cscript>a\x3C/script>
is that expected?

attached screenshot

from dompurify.

Nope, this is what the result looks like:

DOMPurify.sanitize('<script>a</script>',{ADD_TAGS:['script'], FORCE_BODY: true})
//  "<script>a</script>" 

from dompurify.