see #1121

fix: Changed how RETURN_TRUSTED_TYPE=false is being handled

Author: cure53

dist/purify.cjs.js

@@ -253,8 +253,8 @@ const getGlobal = function getGlobal() {
  * @return The policy created (or null, if Trusted Types
  * are not supported or creating the policy failed).
  */
-const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement) {
-  if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function') {
+const _createTrustedTypesPolicy = function _createTrustedTypesPolicy(trustedTypes, purifyHostElement, config) {
+  if (typeof trustedTypes !== 'object' || typeof trustedTypes.createPolicy !== 'function' || config.RETURN_TRUSTED_TYPE === false) {
     return null;
   }
   // Allow the callers to control the unique policy name
@@ -649,7 +649,7 @@ function createDOMPurify() {
     } else {
       // Uninitialized policy, attempt to initialize the internal dompurify policy.
       if (trustedTypesPolicy === undefined) {
-        trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript);
+        trustedTypesPolicy = _createTrustedTypesPolicy(trustedTypes, currentScript, cfg);
       }
       // If creating the internal policy succeeded sign internal variables.
       if (trustedTypesPolicy !== null && typeof emptyHTML === 'string') {

dist/purify.cjs.js.map

@@ -62,11 +62,13 @@ const getGlobal = function (): WindowLike {
  */
 const _createTrustedTypesPolicy = function (
   trustedTypes: TrustedTypePolicyFactory,
-  purifyHostElement: HTMLScriptElement
+  purifyHostElement: HTMLScriptElement,
+  config: Config
 ) {
   if (
     typeof trustedTypes !== 'object' ||
-    typeof trustedTypes.createPolicy !== 'function'
+    typeof trustedTypes.createPolicy !== 'function' ||
+    config.RETURN_TRUSTED_TYPE === false
   ) {
     return null;
   }
@@ -682,7 +684,8 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       if (trustedTypesPolicy === undefined) {
         trustedTypesPolicy = _createTrustedTypesPolicy(
           trustedTypes,
-          currentScript
+          currentScript,
+          cfg
         );
       }