fix: Added smaller-than-null check for __depth hardening code

cure53 · May 8, 2024 · b20ce99 · b20ce99
1 parent 1e52026
commit b20ce99
Show file tree

Hide file tree

Showing 9 changed files with 13 additions and 11 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -1312,7 +1312,7 @@ function createDOMPurify() {
        * Remove an element if nested too deeply to avoid mXSS
        * or if the __depth might have been tampered with
        */
-      if (shadowNode.__depth >= MAX_NESTING_DEPTH || numberIsNaN(shadowNode.__depth)) {
+      if (shadowNode.__depth >= MAX_NESTING_DEPTH || shadowNode.__depth < 0 || numberIsNaN(shadowNode.__depth)) {
         _forceRemove(shadowNode);
       }
 
@@ -1453,7 +1453,7 @@ function createDOMPurify() {
        * Remove an element if nested too deeply to avoid mXSS
        * or if the __depth might have been tampered with
        */
-      if (currentNode.__depth >= MAX_NESTING_DEPTH || numberIsNaN(currentNode.__depth)) {
+      if (currentNode.__depth >= MAX_NESTING_DEPTH || currentNode.__depth < 0 || numberIsNaN(currentNode.__depth)) {
         _forceRemove(currentNode);
       }
 

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1433,6 +1433,7 @@ function createDOMPurify(window = getGlobal()) {
        */
       if (
         shadowNode.__depth >= MAX_NESTING_DEPTH ||
+        shadowNode.__depth < 0 ||
         numberIsNaN(shadowNode.__depth)
       ) {
         _forceRemove(shadowNode);
@@ -1590,6 +1591,7 @@ function createDOMPurify(window = getGlobal()) {
        */
       if (
         currentNode.__depth >= MAX_NESTING_DEPTH ||
+        currentNode.__depth < 0 ||
         numberIsNaN(currentNode.__depth)
       ) {
         _forceRemove(currentNode);