Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add configuration option
RETURN_TRUSTED_TYPE
to DomPurify setup (https://github.com/cure53/DOMPurify?tab=readme-ov-file#what-about-dompurify-and-trusted-types)Description
dangerouslySetInnerHTML will support this type automatically in place of a string.
I don't entirely understand why OAS3 trims the html and the base component doesn't but for now I've chosen to avoid updating a load of expected test values. Happy to change this if desired.
Motivation and Context
This allows enabling
require-trusted-types-for
in CSP to reduce XSS attack surface.How Has This Been Tested?
Tested local dev server with both the default and an oas3 api (https://petstore3.swagger.io/api/v3/openapi.json)
Screenshots (if appropriate):
(Looks the same as before)
Checklist
My PR contains...
src/
is unmodified: changes to documentation, CI, metadata, etc.)package.json
)My changes...
Documentation
Automated tests
There are existing tests covering markdown rendering