@syncfusion/ej2-base 27.1.48 → 27.1.52

package/dist/es6/ej2-base.es2015.js

@@ -9645,6 +9645,7 @@ const removeTags = [
 ];
 const removeAttrs = [
     { attribute: 'href', selector: '[href*="javascript:"]' },
+    { attribute: 'href', selector: 'a[href]' },
     { attribute: 'background', selector: '[background^="javascript:"]' },
     { attribute: 'style', selector: '[style*="javascript:"]' },
     { attribute: 'style', selector: '[style*="expression("]' },
@@ -9806,9 +9807,18 @@ class SanitizeHtmlHelper {
         this.removeAttrs.forEach((item, index) => {
             const elements = this.wrapElement.querySelectorAll(item.selector);
             if (elements.length > 0) {
-                elements.forEach((element) => {
-                    element.removeAttribute(item.attribute);
-                });
+                if (item.selector === 'a[href]') {
+                    elements.forEach((element) => {
+                        if ((element.getAttribute(item.attribute)).replace(/\t|\s|&/, '').indexOf('javascript:alert') !== -1) {
+                            element.removeAttribute(item.attribute);
+                        }
+                    });
+                }
+                else {
+                    elements.forEach((element) => {
+                        element.removeAttribute(item.attribute);
+                    });
+                }
             }
         });
     }