From 027849d8d357fbee7c58b06f1a24bb6d92524772 Mon Sep 17 00:00:00 2001 From: Maks Pikov Date: Tue, 5 May 2026 22:06:48 +0000 Subject: [PATCH 1/2] fix: use scoped DOMPurify instance to avoid mutating global --- src/core/components/providers/markdown.jsx | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/src/core/components/providers/markdown.jsx b/src/core/components/providers/markdown.jsx index 4a08d79157d..bf1a38c6552 100644 --- a/src/core/components/providers/markdown.jsx +++ b/src/core/components/providers/markdown.jsx @@ -5,12 +5,10 @@ import { linkify } from "remarkable/linkify" import DomPurify from "dompurify" import cx from "classnames" -if (DomPurify.addHook) { - DomPurify.addHook("beforeSanitizeElements", function (current, ) { - // Attach safe `rel` values to all elements that contain an `href`, - // i.e. all anchors that are links. - // We _could_ just look for elements that have a non-self target, - // but applying it more broadly shouldn't hurt anything, and is safer. +const scopedDomPurify = typeof window !== "undefined" ? DomPurify(window) : DomPurify + +if (scopedDomPurify.addHook) { + scopedDomPurify.addHook("beforeSanitizeElements", function (current) { if (current.href) { current.setAttribute("rel", "noopener noreferrer") } @@ -62,7 +60,7 @@ export function sanitizer(str, { useUnsafeMarkdown = false } = {}) { sanitizer.hasWarnedAboutDeprecation = true } - return DomPurify.sanitize(str, { + return scopedDomPurify.sanitize(str, { ADD_ATTR: ["target"], FORBID_TAGS: ["style", "form"], ALLOW_DATA_ATTR, From bffc57e98cb60478c583849210fb76912874fd77 Mon Sep 17 00:00:00 2001 From: Maks Pikov Date: Sun, 10 May 2026 22:15:25 +0000 Subject: [PATCH 2/2] fix: add queryConfigEnabled to type-cast mappings queryConfigEnabled was defined in defaults.js but missing from src/core/config/type-cast/mappings.js, meaning the option was not type-cast when provided via URL query parameters or constructor. Fixes #10744 --- src/core/config/type-cast/mappings.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/core/config/type-cast/mappings.js b/src/core/config/type-cast/mappings.js index 2063f101edb..abb7e1f4d54 100644 --- a/src/core/config/type-cast/mappings.js +++ b/src/core/config/type-cast/mappings.js @@ -68,6 +68,10 @@ const mappings = { typeCaster: booleanTypeCaster, defaultValue: defaultOptions.persistAuthorization, }, + queryConfigEnabled: { + typeCaster: booleanTypeCaster, + defaultValue: defaultOptions.queryConfigEnabled, + }, plugins: { typeCaster: arrayTypeCaster, defaultValue: defaultOptions.plugins,