@syncfusion/ej2-base 27.1.50 → 27.1.52

package/dist/es6/ej2-base.es5.js

@@ -9775,6 +9775,7 @@ var removeTags = [
 ];
 var removeAttrs = [
     { attribute: 'href', selector: '[href*="javascript:"]' },
+    { attribute: 'href', selector: 'a[href]' },
     { attribute: 'background', selector: '[background^="javascript:"]' },
     { attribute: 'style', selector: '[style*="javascript:"]' },
     { attribute: 'style', selector: '[style*="expression("]' },
@@ -9939,9 +9940,18 @@ var SanitizeHtmlHelper = /** @__PURE__ @class */ (function () {
         this.removeAttrs.forEach(function (item, index) {
             var elements = _this.wrapElement.querySelectorAll(item.selector);
             if (elements.length > 0) {
-                elements.forEach(function (element) {
-                    element.removeAttribute(item.attribute);
-                });
+                if (item.selector === 'a[href]') {
+                    elements.forEach(function (element) {
+                        if ((element.getAttribute(item.attribute)).replace(/\t|\s|&/, '').indexOf('javascript:alert') !== -1) {
+                            element.removeAttribute(item.attribute);
+                        }
+                    });
+                }
+                else {
+                    elements.forEach(function (element) {
+                        element.removeAttribute(item.attribute);
+                    });
+                }
             }
         });
     };