fix(javascript): add fallback for html user input sanitizer (#176)

Bearer · Nov 7, 2023 · b6a4621 · b6a4621
1 parent ef81184
commit b6a4621
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/rules/javascript/shared/third_parties/sanitize_html_sanitizer.yml b/rules/javascript/shared/third_parties/sanitize_html_sanitizer.yml
@@ -7,6 +7,8 @@ patterns:
   - sanitize($<!>$<_>$<...>)
   # DOMPurifier
   - sanitizeHtml($<!>$<_>$<...>)
+  # fallback
+  - sanitizer($<...>$<!>$<_>$<...>)
 metadata:
   description: "sanitize HTML sanitizer."
   id: javascript_shared_third_parties_sanitize_html_sanitizer
diff --git a/tests/javascript/lang/raw_html_using_user_input/testdata/ok.js b/tests/javascript/lang/raw_html_using_user_input/testdata/ok.js
@@ -1,6 +1,7 @@
 `<h1>#{sanitizeHtml(req.params.ok)}</h1>`
 
 doT.compile(sanitizeHtml(req.params.ok), {})
+doT.compile(sanitizer({ option: true }, req.params.ok), {})
 
 ejs.compile(sanitizeHtml(req.params.ok), {})