Summary

Introducing a new configuration option to allow more flexibility for DOMPurify when used in larger applications which need to handle multiple DOMPurify instances or when allowing a 'dompurify' policy, which DOMPurify attempts to create internally on startup, is not an option.

Background & Context

The feature has been described in #798.
The existing behavior has been maintained, DOMPurify will still try to create its internal policy.

Tasks

• validate internal 'dompurify' policy is created
• create a custom TrustedTypes policy. Call DOMPurify.sanitize('<img />', {TRUSTED_TYPES_POLICY: yourPolicy}) and validate call count for the policy method createHTML is 2 (one for emptyHTML and one when initDocument is called)
• create a custom TrustedTypes policy. Call DOMPurify.sanitize('<img />', {TRUSTED_TYPES_POLICY: yourPolicy, RETURN_TRUSTED_TYPE: true }) and validate call count for the policy method createHTML is 3 (one for emptyHTML, one for initDocument, one for return value)
• create a custom TrustedTypes policy. Create a new instance of DOMPurify and use .setConfig({TRUSTED_TYPES_POLICY: yourPolicy}) to configure the policy only. Call sanitize('<img />') on the new instance and validate call count for the policy method createHTML is 2 (one for emptyHTML and one when initDocument is called)
• create a custom TrustedTypes policy. Create a new instance of DOMPurify and use .setConfig({TRUSTED_TYPES_POLICY: yourPolicy, RETURN_TRUSTED_TYPE: true }) to configure the policy and return type to be a TrustedType. Call sanitize('<img />') and validate call count for the policy method createHTML is 3 (one for emptyHTML, one for initDocument, one for return value)