DOM.purify toast if HTML is allowed
| @@ -2251,6 +2251,11 @@ async function echoCallback(args, value) { | ||
| 2251 | 2251 | } |
| 2252 | 2252 | } |
| 2253 | 2253 | |
| 2254 | + // If we allow HTML, we need to sanitize it to prevent security risks | |
| 2255 | + if (!options.escapeHtml) { | |
| 2256 | + value = DOMPurify.sanitize(value, { FORBID_TAGS: ['style'] }); | |
| 2257 | + } | |
| 2258 | + | |
| 2254 | 2259 | let toast; |
| 2255 | 2260 | switch (severity) { |
| 2256 | 2261 | case 'error': |