| 1 | # DOMPurify Vendor DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the vendored DOMPurify sanitizer module used for safe HTML rendering. |
| 6 | |
| 7 | ## Ownership |
| 8 | |
| 9 | - `purify.es.mjs` owns the browser module imported by WebUI sanitization paths. |
| 10 | |
| 11 | ## Local Contracts |
| 12 | |
| 13 | - Do not weaken sanitizer behavior through local edits. |
| 14 | - Keep import paths synchronized with markdown and message rendering code. |
| 15 | |
| 16 | ## Work Guidance |
| 17 | |
| 18 | - Replace with a clean upstream module when updating. |
| 19 | - Coordinate sanitizer updates with security-sensitive rendering tests. |
| 20 | |
| 21 | ## Verification |
| 22 | |
| 23 | - Run or manually exercise HTML/markdown rendering paths after changes. |
| 24 | |
| 25 | ## Child DOX Index |
| 26 | |
| 27 | No child DOX files. |