title: DOMPurify for XSS
body: <p>I am trying to fix the cross side scripting (XSS) with the DOMPurify . The vulnerability found is in the URL as below .
  <a href="https://stage-xyzmysite.com/login/?rUrl=javascript:alert(%27hi%27)" rel="nofollow noreferrer">https://stage-xyzmysite.com/login/?rUrl=javascript:alert('hi')</a> . I am trying to do a simple POC where it will try to eliminate the javascript alert part . I tried with DOMPurify.sanitize(&lt; the url here &gt; ) . I am expecting to see the javascript part getting removed but it is not happening . If I enclose the alert with  tag in the URL then it is getting eliminated. Is there any other special config I should be using ?</p>