From 17f349b33d4a4b72be9db4bdc835b2e52acf19e9 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Tue, 16 May 2023 23:21:15 +0100
Subject: [PATCH] [v9.5.x] Chore: remove pre tags from DOMPurify config
 (#68592)

Chore: remove pre tags from DOMPurify config (#68512)

(cherry picked from commit 4ccaf801d755aab5b968bf876c13d390ef90c56b)

Co-authored-by: Kristian Bremberg <114284895+KristianGrafana@users.noreply.github.com>
---
 packages/grafana-data/src/text/sanitize.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/grafana-data/src/text/sanitize.ts b/packages/grafana-data/src/text/sanitize.ts
index 8f053b530b5..c1076cdccad 100644
--- a/packages/grafana-data/src/text/sanitize.ts
+++ b/packages/grafana-data/src/text/sanitize.ts
@@ -33,13 +33,13 @@ const sanitizeTextPanelWhitelist = new xss.FilterXSS({
 /**
  * Return a sanitized string that is going to be rendered in the browser to prevent XSS attacks.
  * Note that sanitized tags will be removed, such as "<script>".
- * We don't allow form, pre, or input elements.
+ * We don't allow form or input elements.
  */
 export function sanitize(unsanitizedString: string): string {
   try {
     return DOMPurify.sanitize(unsanitizedString, {
       USE_PROFILES: { html: true },
-      FORBID_TAGS: ['form', 'input', 'pre'],
+      FORBID_TAGS: ['form', 'input'],
     });
   } catch (error) {
     console.error('String could not be sanitized', unsanitizedString);