Merge pull request #541 from NateScarlet/fix-default-namespace

Fix issues caused by missing config reset

Author: cure53

dist/purify.cjs.js

@@ -384,7 +384,7 @@ function createDOMPurify(window = getGlobal()) {
     KEEP_CONTENT = cfg.KEEP_CONTENT !== false; // Default true
     IN_PLACE = cfg.IN_PLACE || false; // Default false
     IS_ALLOWED_URI = cfg.ALLOWED_URI_REGEXP || IS_ALLOWED_URI;
-    NAMESPACE = cfg.NAMESPACE || NAMESPACE;
+    NAMESPACE = cfg.NAMESPACE || HTML_NAMESPACE;
     if (SAFE_FOR_TEMPLATES) {
       ALLOW_DATA_ATTR = false;
     }
@@ -1106,9 +1106,9 @@ function createDOMPurify(window = getGlobal()) {
     /* Make sure we have a string to sanitize.
       DO NOT return early, as this will return the wrong type if
       the user has requested a DOM object rather than a string */
-    if (!dirty) {
+    IS_EMPTY_INPUT = !dirty;
+    if (IS_EMPTY_INPUT) {
       dirty = '<!-->';
-      IS_EMPTY_INPUT = true;
     }
 
     /* Stringify, in case dirty is an object */

dist/purify.cjs.js.map

@@ -1615,4 +1615,47 @@ module.exports = function (DOMPurify, window, tests, xssTests) {
       assert.contains(clean, test.expected);
     });
   });
+
+  QUnit.test('Test namespace default to html after other namespace been used', function (assert) {
+    var tests = [
+      {
+        test: '<br>',
+        config: { NAMESPACE: 'http://www.w3.org/2000/svg' },
+        expected: [''],
+      },
+      {
+        test: '<br>',
+        config: { },
+        expected: ['<br>'],
+      },
+    ];
+    tests.forEach(function (test) {
+      var clean = DOMPurify.sanitize(test.test, test.config);
+      assert.contains(clean, test.expected);
+    });
+  });
+
+  QUnit.test('Test non-html input after empty input', function (assert) {
+    var tests = [
+      {
+        test: '',
+        config: { NAMESPACE: 'http://www.w3.org/2000/svg' },
+        expected: [''],
+      },
+      {
+        test: '<polyline points="0 0"></polyline>',
+        config: { NAMESPACE: 'http://www.w3.org/2000/svg' },
+        expected: [
+          '<polyline points="0 0"></polyline>',
+          '<polyline xmlns="http://www.w3.org/2000/svg" points="0 0"/>',
+          '<polyline xmlns="http://www.w3.org/2000/svg" points="0,0" />',
+          '',
+        ],
+      },
+    ];
+    tests.forEach(function (test) {
+      var clean = DOMPurify.sanitize(test.test, test.config);
+      assert.contains(clean, test.expected);
+    });
+  });
 };