Jakub Zych
c1d767f0f8
- displayHtml uses a dedicated DOMPurify 3.4.16 instance: EDITOR_TAGS, href only on <a> through isAllowedLink, DROPPED elements go with their content - string in, string out: parsed into DOMPurify's inert document, nothing adopted into the live document before binding - fails closed (empty string) unless isSupported and a fixed canary hold - Vitest browser mode in Playwright Chromium (npm run test:browser) covers the clobbering vectors, off-origin form, iframe, meta refresh, links and the inert parse; happy-dom keeps engine-independent assertions
22 lines
710 B
TypeScript
22 lines
710 B
TypeScript
import { defineConfig } from 'vitest/config'
|
|
import vue from '@vitejs/plugin-vue'
|
|
|
|
// Vitest browser mode in Playwright Chromium (npm run test:browser), for tests
|
|
// that need a real engine: happy-dom reproduces neither DOM clobbering nor
|
|
// DOMPurify's walk. tests/setup.ts is a happy-dom shim and is not loaded here.
|
|
// Decision note: .planning/notes/2026-10-12-admin-display-sanitizer-dompurify.md
|
|
export default defineConfig({
|
|
plugins: [vue()],
|
|
test: {
|
|
include: ['tests/browser/**/*.test.ts'],
|
|
restoreMocks: true,
|
|
browser: {
|
|
enabled: true,
|
|
provider: 'playwright',
|
|
headless: true,
|
|
screenshotFailures: false,
|
|
instances: [{ browser: 'chromium' }],
|
|
},
|
|
},
|
|
})
|