Should we protect against DOM clobbering by default?

[cure53]

Right now, DOMPurify protects itself against DOM Clobbering. But the resulting markup itself still has clobbering potential when being used by the sanitizing website.

Should be by default prevent that? My thought would be: If an element's name is at the same time a property in document, the element should be removed. What do you think? We would prevent XSS and DOM clobbering.

//cc @fhemberger @mathiasbynens

[mathiasbynens]

Sounds good to me! The only downside is that sanitize() wouldn’t be a pure/deterministic function anymore… But that doesn’t really matter. Improved security is more important.

[cure53]

We can always use a flag. Question is more like: default or not ;)

[cure53]

I think this can be close, it's part of the code, behind a config flag and no one objected so far ;)