Function toString

test/test-suite.js:6215–6217

()

    QUnit.test('coerced toString() markup is still sanitized', (assert) => {
      const dirty = {
        toString() {
          return '<b>x</b><img src=x onerror=alert(1)>';
        },
      };
      const out = DOMPurify.sanitize(dirty);
      assert.equal(out.indexOf('onerror'), -1, `onerror survived: ${out}`);