Fix Trusted Types Sink violation with empty input and NAMESPACE

cure53 · Dec 19, 2022 · 191cc00 · 191cc00
1 parent 4945074
commit 191cc00
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/purify.js b/src/purify.js
@@ -844,7 +844,7 @@ function createDOMPurify(window = getGlobal()) {
     if (!doc || !doc.documentElement) {
       doc = implementation.createDocument(NAMESPACE, 'template', null);
       try {
-        doc.documentElement.innerHTML = IS_EMPTY_INPUT ? '' : dirtyPayload;
+        doc.documentElement.innerHTML = IS_EMPTY_INPUT ? emptyHTML : dirtyPayload;
       } catch (_) {
         // Syntax error if dirtyPayload is invalid xml
       }