Preserve target=_blank attribute when purifying (fix #793)

dimdenGD · Jul 13, 2024 · f7e2380 · f7e2380
1 parent 7b45404
commit f7e2380
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/scripts/helpers.js b/scripts/helpers.js
@@ -384,7 +384,8 @@ function escapeHTML(unsafe) {
     if(typeof unsafe === 'undefined' || unsafe === null) {
         return '';
     }
-    return DOMPurify.sanitize(String(unsafe));
+
+    return DOMPurify.sanitize(String(unsafe), { ADD_ATTR: ['target'] });
 }
 
 function html(strings, ...values) {