Whitespace sanitization behavior changed

[makepanic]

This issue proposes a bug which...

Background & Context

Hi,
thanks for developing this great package.
I'm in the progress of updating from 1.x.x to 2.x.x and noticed our tests failing.

It seems like 2.x.x introduced a changed behavior when sanitizing a whitespace character string.
Previously it returned the whitespace string but now it's an empty string.

I'm not sure if this is a bug or expected behavior. We're invoking the sanitize method like this: sanitize(text, { ALLOWED_TAGS: [] })

Bug

Input

- (whitespace character ASCII 32)

Given output

`` - (empty string: string.length === 0)

Expected output

- (whitespace character ASCII 32)

[peterblazejewicz]

@makepanic
what is the version you're using?
See: #372

[cure53]

I think I found the problem.

MSIE11 won't create a full document if body.outerHTML gets set to an empty string. That would cause the exception. With the fix, we addressed #372 successfully but indeed the root cause was something else.

[cure53]

Let's see what the other browsers say... :D

[cure53]

I think master is ready for a quick review, should be fixed imho.

[makepanic]

Thanks for the quick reply.

what is the version you're using?

2.0.7 tested it only in chrome

[makepanic]

Just tried cure53/DOMPurify#3a303715d73de342e25e8437cc59552334823092 in our tests and it seems to have fixed the whitespace regression 👍

[cure53]

Awesome :D