Skip to content

Commit 02724b8

Browse files
committed
fix: attemtping to fix another mutation behavior
1 parent 63061bf commit 02724b8

10 files changed

+16
-10
lines changed

Diff for: dist/purify.cjs.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.cjs.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.es.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.es.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: dist/purify.min.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: src/purify.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -674,7 +674,7 @@ function createDOMPurify(window = getGlobal()) {
674674
/* Take care of an mXSS pattern using p, br inside svg, math */
675675
if (
676676
(tagName === 'svg' || tagName === 'math') &&
677-
currentNode.querySelectorAll('p, br, form').length !== 0
677+
currentNode.querySelectorAll('p, br, form, table').length !== 0
678678
) {
679679
_forceRemove(currentNode);
680680
return true;

Diff for: test/fixtures/expect.js

+7-1
Original file line numberDiff line numberDiff line change
@@ -1075,11 +1075,17 @@ module.exports = [
10751075
"<svg></svg><b><style><b title='</style><img>'&gt;</b>"
10761076
]
10771077
}, {
1078-
"title": "Tests against nesting-based mXSS behavior 1/1",
1078+
"title": "Tests against nesting-based mXSS behavior 1/2",
10791079
"payload": "<form><math><mtext></form><form><mglyph><style><img>",
10801080
"expected": [
10811081
"<form></form>"
10821082
]
1083+
}, {
1084+
"title": "Tests against nesting-based mXSS behavior 2/2",
1085+
"payload": "<math><mtext><table><mglyph><style><math>CLICKME</math>",
1086+
"expected": [
1087+
""
1088+
]
10831089
}, {
10841090
"title": "Tests against proper handling of leading whitespaces",
10851091
"payload": " ",

0 commit comments

Comments
 (0)