@justeattakeaway/pie-cookie-banner 1.8.2 → 1.9.0

package/custom-elements.json

@@ -530,6 +530,28 @@
           ],
           "description": "Localises a plain text string\nIf the key is not found, it will be used as fallback"
         },
+        {
+          "kind": "function",
+          "name": "sanitiseDescriptionHtml",
+          "return": {
+            "type": {
+              "text": "string"
+            }
+          },
+          "parameters": [
+            {
+              "name": "input",
+              "type": {
+                "text": "string"
+              }
+            },
+            {
+              "name": "linkTarget",
+              "default": "'_blank'"
+            }
+          ],
+          "description": "Sanitises an HTML string to allow only safe <a> tags, and normalises anchor\nattributes to respect the component's link-target behaviour.\n\nUses DOMPurify for the core sanitisation:\n- Strips all non-<a> elements (keeping their text content).\n- Removes unsafe href protocols (javascript:, data:, vbscript:).\n- Removes non-allowlisted attributes (only href, rel, target survive).\n\nA post-sanitisation hook then enforces target/rel:\n- Sets target to linkTarget (overrides any existing target).\n- Ensures rel contains \"noopener noreferrer\" when target=\"_blank\"\n  (prevents reverse-tabnabbing).\n\nIn SSR / non-browser environments (no `window`), all HTML is stripped and\nonly the text content is returned — the client will re-render with the full\nsanitisation pass after hydration."
+        },
         {
           "kind": "function",
           "name": "localiseRichText",
@@ -573,6 +595,14 @@
             "module": "src/localisation-utils.js"
           }
         },
+        {
+          "kind": "js",
+          "name": "sanitiseDescriptionHtml",
+          "declaration": {
+            "name": "sanitiseDescriptionHtml",
+            "module": "src/localisation-utils.js"
+          }
+        },
         {
           "kind": "js",
           "name": "localiseRichText",