Remove attribute sanitization from DOMPurify configuration

What does this MR do?

Due to a bug in DOMPurify, we had to implement potentially dangerous data-* attribute sanitization using hooks. These checks can be removed now as they are no longer needed.

This will allow v-safe-html to configure if it should allow these attributes for inputs that are safe.

This reverts changes (except specs) introduced in !65301 (merged).

Screenshots or Screencasts (strongly suggested)

NA

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #335684 (closed)

Edited by Dheeraj Joshi

Merge request reports

Loading