Restore ability to execute remote content scripts

docsifyjs · Feb 5, 2021 · 0059ba2 · 0059ba2
1 parent e6c6abb
commit 0059ba2
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/packages/docsify-server-renderer/index.js b/packages/docsify-server-renderer/index.js
@@ -123,7 +123,9 @@ export default class Renderer {
       this._renderHtml('cover', await this._render(coverFile), 'cover');
     }
 
-    const html = this.isRemoteUrl ? DOMPurify.sanitize(this.html) : this.html;
+    const html = this.isRemoteUrl
+      ? DOMPurify.sanitize(this.html, { ADD_TAGS: ['script'] })
+      : this.html;
     this.html = this.template;
     return html;
   }

diff --git a/src/core/render/index.js b/src/core/render/index.js
@@ -330,7 +330,9 @@ export function renderMixin(proto) {
           },
           tokens => {
             html = this.compiler.compile(tokens);
-            html = this.isRemoteUrl ? DOMPurify.sanitize(html) : html;
+            html = this.isRemoteUrl
+              ? DOMPurify.sanitize(html, { ADD_TAGS: ['script'] })
+              : html;
             callback();
             next();
           }