Skip to content

Commit

Permalink
Merge pull request #942 from kyselberg/main
Browse files Browse the repository at this point in the history
docs(README.md): correct hook name in example and remove misleading comment
  • Loading branch information
cure53 committed Apr 25, 2024
2 parents ef4bbb4 + 2a554b4 commit c0d418c
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions README.md
Expand Up @@ -73,7 +73,7 @@ After sanitizing your markup, you can also have a look at the property `DOMPurif

DOMPurify technically also works server-side with Node.js. Our support strives to follow the [Node.js release cycle](https://nodejs.org/en/about/releases/).

Running DOMPurify on the server requires a DOM to be present, which is probably no surprise. Usually, [jsdom](https://github.com/jsdom/jsdom) is the tool of choice and we **strongly recommend** to use the latest version of _jsdom_.
Running DOMPurify on the server requires a DOM to be present, which is probably no surprise. Usually, [jsdom](https://github.com/jsdom/jsdom) is the tool of choice and we **strongly recommend** to use the latest version of _jsdom_.

Why? Because older versions of _jsdom_ are known to be buggy in ways that result in XSS _even if_ DOMPurify does everything 100% correctly. There are **known attack vectors** in, e.g. _jsdom v19.0.0_ that are fixed in _jsdom v20.0.0_ - and we really recommend to keep _jsdom_ up to date because of that.

Expand Down Expand Up @@ -369,11 +369,11 @@ _Example_:
```js
DOMPurify.addHook(
'beforeSanitizeElements',
'uponSanitizeAttribute',
function (currentNode, hookEvent, config) {
// Do something with the current node and return it
// You can also mutate hookEvent (i.e. set hookEvent.forceKeepAttr = true)
return currentNode;
// Do something with the current node
// You can also mutate hookEvent for current node (i.e. set hookEvent.forceKeepAttr = true)
// For other than 'uponSanitizeAttribute' hook types hookEvent equals to null
}
);
```
Expand Down

0 comments on commit c0d418c

Please sign in to comment.