Reuse preview sanitizer across client page bundles
Quality / quality (ubuntu-latest) (push) Canceled after 0s
Quality / quality (windows-latest) (push) Canceled after 0s

This commit is contained in:
Clintchiz committed 2026-10-01 20:19:08 +05:30
1 parent 646814d6df
commit a023049431
4 files changed
+20 -5

No files matched your search

+6 -3
View File
@@ -1,14 +1,17 @@
import createDOMPurify from "dompurify";
const sanitizers = new WeakMap<object, ReturnType<typeof createDOMPurify>>();
// Page modules are bundled separately. Keep the sanitizer on the realm so SPA
// navigation reuses its Trusted Types policy instead of creating it twice.
const sanitizerKey = Symbol.for("wrnexus.block-editor.preview-sanitizer");
type PreviewRealm = Window & { [sanitizerKey]?: ReturnType<typeof createDOMPurify> };
/** Sanitize generated previews in the sink's realm, including Trusted Types. */
export function builderPreviewHTML(html: string, doc: Document = document): string {
const realm = doc.defaultView;
if (!realm) throw new Error("Preview document has no browser realm");
let sanitizer = sanitizers.get(realm);
let sanitizer = (realm as PreviewRealm)[sanitizerKey];
if (!sanitizer) {
sanitizer = createDOMPurify(realm);
sanitizers.set(realm, sanitizer);
Object.defineProperty(realm, sanitizerKey, { value: sanitizer });
}
return sanitizer.sanitize(html, {
WHOLE_DOCUMENT: true,