DOM.purify toast if HTML is allowed
| @@ -2251,6 +2251,11 @@ async function echoCallback(args, value) { | |||
| 2251 | } | 2251 | } |
| 2252 | } | 2252 | } |
| 2253 | 2253 | ||
| 2254 | // If we allow HTML, we need to sanitize it to prevent security risks | ||
| 2255 | if (!options.escapeHtml) { | ||
| 2256 | value = DOMPurify.sanitize(value, { FORBID_TAGS: ['style'] }); | ||
| 2257 | } | ||
| 2258 | |||
| 2254 | let toast; | 2259 | let toast; |
| 2255 | switch (severity) { | 2260 | switch (severity) { |
| 2256 | case 'error': | 2261 | case 'error': |