Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!defined(markdownString) || markdownString.length === 0) {
return markdownString;
}
// If the text looks like html, don't try to interpret it as Markdown because
// we'll probably break it in the process.
var unsafeHtml;
if (htmlRegex.test(markdownString)) {
unsafeHtml = markdownString;
} else {
// Note this would wrap non-standard tags such as hi in a <p></p>, which is bad.
unsafeHtml = md.render(markdownString);
}
if (allowUnsafeHtml) {
return unsafeHtml;
} else {
return DOMPurify.sanitize(unsafeHtml, options);
}
}
unsafeHtml = markdownString;
} else {
// MarkdownIt can't handle something that is not a string primitve. It can't even handle
// something that is a string object (instanceof String) rather a string primitive
// (typeof string === 'string'). So if this isn't a string primitive, call toString
// on it in order to make it one.
if (markdownString && typeof markdownString !== "string") {
markdownString = markdownString.toString();
}
unsafeHtml = md.render(markdownString);
}
if (allowUnsafeHtml) {
return unsafeHtml;
} else {
return DOMPurify.sanitize(unsafeHtml, options);
}
}
renderAttribution(attribution) {
// For reasons I don't entirely understanding, using parseCustomHtmlToReact instead
// of dangerouslySetInnerHTML here doesn't work in IE11 or Edge. All elements after
// the first attribution end up just completely missing from the DOM.
const html = { __html: DOMPurify.sanitize(attribution) };
return <li>;
},
</li>