diff --git a/src/lib/tiptap-video.ts b/src/lib/tiptap-video.ts index 2878b21..6831794 100644 --- a/src/lib/tiptap-video.ts +++ b/src/lib/tiptap-video.ts @@ -14,7 +14,7 @@ export const VideoExtension = Node.create({ addAttributes() { return { src: { default: null }, - controls: { default: true }, + controls: { default: '' }, class: { default: null }, preload: { default: 'metadata' }, }; @@ -25,6 +25,6 @@ export const VideoExtension = Node.create({ }, renderHTML({ HTMLAttributes }) { - return ['video', mergeAttributes(HTMLAttributes, { controls: '' })]; + return ['video', mergeAttributes(HTMLAttributes)]; }, }); diff --git a/src/pages/NewsArticle.tsx b/src/pages/NewsArticle.tsx index 04962e7..79a1efb 100644 --- a/src/pages/NewsArticle.tsx +++ b/src/pages/NewsArticle.tsx @@ -164,16 +164,17 @@ const SANITIZE_CONFIG = { }; /** - * Sanitize HTML with scoped DOMPurify hooks. - * - * Hooks are registered/removed inside this function to avoid polluting the - * global DOMPurify instance (other pages use DOMPurify with their own config). + * Isolated DOMPurify instance for article content sanitization. + * Using a separate instance avoids polluting the global DOMPurify singleton + * that other pages may use with their own hooks/config. */ +const articlePurify = DOMPurify(window); + function sanitizeHtml(html: string): string { - DOMPurify.removeAllHooks(); + articlePurify.removeAllHooks(); // Hook: strip iframes with disallowed src - DOMPurify.addHook('afterSanitizeAttributes', (node) => { + articlePurify.addHook('afterSanitizeAttributes', (node) => { if (node.tagName === 'IFRAME') { const src = node.getAttribute('src') ?? ''; if (!isAllowedIframeSrc(src)) { @@ -191,7 +192,7 @@ function sanitizeHtml(html: string): string { // Hook: validate