hanzoai/DOMPurify
2
0
Fork 0
mirror of https://github.com/hanzoai/DOMPurify.git synced 2026-09-24 16:55:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Added smaller fixes addressing several LLM bug reports

Browse Source
This commit is contained in:
Mario Heiderich
2026-02-24 13:55:29 +01:00
parent dc018f8bf3
commit e0d3ddf76f
9 changed files with 56 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/purify.cjs.js
Vendored
+12 -1
View File
@@ -602,7 +602,7 @@ function createDOMPurify() {
/* Parse profile info */
if (USE_PROFILES) {
ALLOWED_TAGS = addToSet({}, text);
ALLOWED_ATTR = [];
ALLOWED_ATTR = create(null);
if (USE_PROFILES.html === true) {
addToSet(ALLOWED_TAGS, html$1);
addToSet(ALLOWED_ATTR, html);
@@ -623,6 +623,13 @@ function createDOMPurify() {
addToSet(ALLOWED_ATTR, xml);
}
}
/* Prevent function-based ADD_ATTR / ADD_TAGS from leaking across calls */
if (!objectHasOwnProperty(cfg, 'ADD_TAGS')) {
EXTRA_ELEMENT_HANDLING.tagCheck = null;
}
if (!objectHasOwnProperty(cfg, 'ADD_ATTR')) {
EXTRA_ELEMENT_HANDLING.attributeCheck = null;
}
/* Merge configuration parameters */
if (cfg.ADD_TAGS) {
if (typeof cfg.ADD_TAGS === 'function') {
@@ -1020,6 +1027,10 @@ function createDOMPurify() {
*/
// eslint-disable-next-line complexity
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
/* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
if (FORBID_ATTR[lcName]) {
return false;
}
/* Make sure attribute cannot clobber */
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
return false;
dist/purify.cjs.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/purify.es.mjs
Vendored
+12 -1
View File
@@ -600,7 +600,7 @@ function createDOMPurify() {
/* Parse profile info */
if (USE_PROFILES) {
ALLOWED_TAGS = addToSet({}, text);
ALLOWED_ATTR = [];
ALLOWED_ATTR = create(null);
if (USE_PROFILES.html === true) {
addToSet(ALLOWED_TAGS, html$1);
addToSet(ALLOWED_ATTR, html);
@@ -621,6 +621,13 @@ function createDOMPurify() {
addToSet(ALLOWED_ATTR, xml);
}
}
/* Prevent function-based ADD_ATTR / ADD_TAGS from leaking across calls */
if (!objectHasOwnProperty(cfg, 'ADD_TAGS')) {
EXTRA_ELEMENT_HANDLING.tagCheck = null;
}
if (!objectHasOwnProperty(cfg, 'ADD_ATTR')) {
EXTRA_ELEMENT_HANDLING.attributeCheck = null;
}
/* Merge configuration parameters */
if (cfg.ADD_TAGS) {
if (typeof cfg.ADD_TAGS === 'function') {
@@ -1018,6 +1025,10 @@ function createDOMPurify() {
*/
// eslint-disable-next-line complexity
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
/* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
if (FORBID_ATTR[lcName]) {
return false;
}
/* Make sure attribute cannot clobber */
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
return false;
dist/purify.es.mjs.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/purify.js
Vendored
+12 -1
View File
@@ -606,7 +606,7 @@
/* Parse profile info */
if (USE_PROFILES) {
ALLOWED_TAGS = addToSet({}, text);
ALLOWED_ATTR = [];
ALLOWED_ATTR = create(null);
if (USE_PROFILES.html === true) {
addToSet(ALLOWED_TAGS, html$1);
addToSet(ALLOWED_ATTR, html);
@@ -627,6 +627,13 @@
addToSet(ALLOWED_ATTR, xml);
}
}
/* Prevent function-based ADD_ATTR / ADD_TAGS from leaking across calls */
if (!objectHasOwnProperty(cfg, 'ADD_TAGS')) {
EXTRA_ELEMENT_HANDLING.tagCheck = null;
}
if (!objectHasOwnProperty(cfg, 'ADD_ATTR')) {
EXTRA_ELEMENT_HANDLING.attributeCheck = null;
}
/* Merge configuration parameters */
if (cfg.ADD_TAGS) {
if (typeof cfg.ADD_TAGS === 'function') {
@@ -1024,6 +1031,10 @@
*/
// eslint-disable-next-line complexity
const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
/* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
if (FORBID_ATTR[lcName]) {
return false;
}
/* Make sure attribute cannot clobber */
if (SANITIZE_DOM && (lcName === 'id' || lcName === 'name') && (value in document || value in formElement)) {
return false;
dist/purify.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/purify.min.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/purify.min.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
src/purify.ts
+15 -1
View File
@@ -610,7 +610,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
/* Parse profile info */
if (USE_PROFILES) {
ALLOWED_TAGS = addToSet({}, TAGS.text);
ALLOWED_ATTR = [];
ALLOWED_ATTR = create(null);
if (USE_PROFILES.html === true) {
addToSet(ALLOWED_TAGS, TAGS.html);
addToSet(ALLOWED_ATTR, ATTRS.html);
@@ -635,6 +635,15 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
}
}
/* Prevent function-based ADD_ATTR / ADD_TAGS from leaking across calls */
if (!objectHasOwnProperty(cfg, 'ADD_TAGS')) {
EXTRA_ELEMENT_HANDLING.tagCheck = null;
}
if (!objectHasOwnProperty(cfg, 'ADD_ATTR')) {
EXTRA_ELEMENT_HANDLING.attributeCheck = null;
}
/* Merge configuration parameters */
if (cfg.ADD_TAGS) {
if (typeof cfg.ADD_TAGS === 'function') {
@@ -1202,6 +1211,11 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
lcName: string,
value: string
): boolean {
/* FORBID_ATTR must always win, even if ADD_ATTR predicate would allow it */
if (FORBID_ATTR[lcName]) {
return false;
}
/* Make sure attribute cannot clobber */
if (
SANITIZE_DOM &&