add missing forbid tags config in sanitization (#49)

ensdomains · Jul 11, 2024 · 788f0f2 · 788f0f2
1 parent f64e898
commit 788f0f2
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/package.json b/package.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-alpha.2.ethers.6",
+  "version": "1.0.0-alpha.3.ethers.6",
   "license": "MIT",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",

diff --git a/src/utils/getImageURI.ts b/src/utils/getImageURI.ts
@@ -71,7 +71,9 @@ function _sanitize(data: string, jsDomWindow?: any): Buffer {
   });
 
   // purges malicious scripting from svg content
-  const cleanDOM = DOMPurify.sanitize(data);
+  const cleanDOM = DOMPurify.sanitize(data, {
+    FORBID_TAGS: ['a', 'area', 'base', 'iframe', 'link'],
+  });
   return Buffer.from(cleanDOM);
 }