Reuse preview sanitizer across client page bundles
This commit is contained in:
1 parent
646814d6df
commit
a023049431
4 files changed
+20
-5
No files matched your search
@@ -1,14 +1,17 @@
|
||||
import createDOMPurify from "dompurify";
|
||||
|
||||
const sanitizers = new WeakMap<object, ReturnType<typeof createDOMPurify>>();
|
||||
// Page modules are bundled separately. Keep the sanitizer on the realm so SPA
|
||||
// navigation reuses its Trusted Types policy instead of creating it twice.
|
||||
const sanitizerKey = Symbol.for("wrnexus.block-editor.preview-sanitizer");
|
||||
type PreviewRealm = Window & { [sanitizerKey]?: ReturnType<typeof createDOMPurify> };
|
||||
/** Sanitize generated previews in the sink's realm, including Trusted Types. */
|
||||
export function builderPreviewHTML(html: string, doc: Document = document): string {
|
||||
const realm = doc.defaultView;
|
||||
if (!realm) throw new Error("Preview document has no browser realm");
|
||||
let sanitizer = sanitizers.get(realm);
|
||||
let sanitizer = (realm as PreviewRealm)[sanitizerKey];
|
||||
if (!sanitizer) {
|
||||
sanitizer = createDOMPurify(realm);
|
||||
sanitizers.set(realm, sanitizer);
|
||||
Object.defineProperty(realm, sanitizerKey, { value: sanitizer });
|
||||
}
|
||||
return sanitizer.sanitize(html, {
|
||||
WHOLE_DOCUMENT: true,
|
||||
|
||||
Reference in new issue
Block a user