@valtimo/components 13.50.0 → 13.50.1

package/fesm2022/valtimo-components.mjs

@@ -56,6 +56,7 @@ import { OverlayModule, Overlay } from '@angular/cdk/overlay';
 import Currency from '@tadashi/currency';
 import flatpickr from 'flatpickr';
 import { Dutch } from 'flatpickr/dist/l10n/nl';
+import createDOMPurify from 'dompurify';
 import * as i2$4 from 'ngx-spinner';
 import { NgxSpinnerModule } from 'ngx-spinner';
 import Search16 from '@carbon/icons/es/search/16';
@@ -13103,6 +13104,35 @@ function registerFormioFlatpickr() {
     };
 }
 
+/*
+ * Copyright 2015-2026 Ritense BV, the Netherlands.
+ *
+ * Licensed under EUPL, Version 1.2 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const SANITIZE_CONFIG = {
+    FORBID_TAGS: ['form', 'input', 'button', 'textarea', 'select'],
+};
+// Use an isolated DOMPurify instance so the anchor hook below does not leak onto
+// the shared singleton that formiojs (and other libraries) sanitize with.
+const purifier = createDOMPurify(window);
+purifier.addHook('afterSanitizeAttributes', node => {
+    if (node.tagName === 'A') {
+        node.setAttribute('target', '_blank');
+        node.setAttribute('rel', 'noopener noreferrer');
+    }
+});
+const sanitizeEmailHtml = (html) => purifier.sanitize(html, SANITIZE_CONFIG);
+
 /*
  * Copyright 2015-2026 Ritense BV, the Netherlands.
  *
@@ -13121,7 +13151,7 @@ function registerFormioFlatpickr() {
 class FormIoMailPreviewComponent {
     set value(v) {
         this._value = v;
-        this.safeValue = this.sanitizer.bypassSecurityTrustHtml(v ?? 'Hier wordt het e-mailvoorbeeld getoond.');
+        this.safeValue = this.sanitizer.bypassSecurityTrustHtml(sanitizeEmailHtml(v ?? 'Hier wordt het e-mailvoorbeeld getoond.'));
     }
     get value() {
         return this._value;