* fix: addressed an issue with hook-handling for CE sanitization, thanks @Rikuxx0
* chore: rebuild dist to sync purify.min.js + sourcemaps after main merge
Both are pure presentation attributes from the W3C SVG2 text property
adaptions but were missing from the SVG attribute allow-list, so
DOMPurify stripped e.g. <text dominant-baseline="middle">. Their
baseline siblings alignment-baseline and baseline-shift are already
allow-listed; both added attributes are enum-only with no script/URL
surface.
Fixes#1525
Co-authored-by: Hanzo Dev <[email protected]>
* * feat: block declarative-partial-updates patch directives
* feat: harden style mXSS check against foreign-content teleport
* fefend against declarative partial updates (Chrome 150)
* test: add tests for partial-update patch directives
* feat: loosened the style check a bit again
test: added correct test coverage for template scrubbing
* fix: slightly changed behavior of node removal to avoid breakage, see #1521
* chore: regenerated dist files to be in sync again
* fix: made sure that _neutralizeRoot calls _neutralizeSubtree first
* test: added tests for the formerly addressed IN_PLACE behavior
* chore: fixed the out-of-sync dist files
* chore: hardened against several smaller declarative patching crashes
* test: extended tests to cover more declarative patching cases
* * feat: block declarative-partial-updates patch directives
* feat: harden style mXSS check against foreign-content teleport
* fefend against declarative partial updates (Chrome 150)
* test: add tests for partial-update patch directives
* feat: loosened the style check a bit again
test: added correct test coverage for template scrubbing
* fix: slightly changed behavior of node removal to avoid breakage, see #1521
* chore: regenerated dist files to be in sync again
* fix: hook allowlist clone-guard now covers the setConfig() path
* test: added test coverage for recent config leak fixes
* fix: hardened the entry points for hooks
* docs: updated threat model docs to be more accurate regarding exotic configs
refactor: extract public type declarations into src/types.ts
Moves the type-level code (DOMPurify interface, hook types,
RemovedElement/RemovedAttribute, WindowLike, HooksMap) from the bottom
of purify.ts into src/types.ts. purify.ts imports what it references
and re-exports the public surface unchanged.
No emitted-JS change: all four runtime bundles rebuild byte-identical.
Bundled d.ts is semantically identical (only 'declare const _default'
moves after the type block). verify-typescript passes for all consumer
flavors.
refactor: single source of truth for integration point defaults
The default MATHML_TEXT_INTEGRATION_POINTS and HTML_INTEGRATION_POINTS
arrays were written twice - at declaration and inline in _parseConfig.
Extract frozen DEFAULT_* constants (elements already lowercase, so
addToSet's isFrozen guard is a no-op) referenced from both sites. A
fresh set object is still allocated per parse, exactly as before.
refactor: remove dead branches, fix internal naming, align hardened style
- _isValidAttribute: drop the FORBID_ATTR[lcName] re-checks; both sit
after the unconditional early return and FORBID_ATTR cannot change
between the two points, so they were constants.
- Remove unreachable direct-property fallbacks on getChildNodes /
getAttributes / getShadowRoot: lookupGetter always returns a
callable, and the dead fallback was the clobberable read. The
nullable getNodeType/getNodeName ternaries stay.
- NODE_TYPE.progressingInstruction -> processingInstruction (internal).
- seal() the per-config CUSTOM_ELEMENT_HANDLING, matching the sealed
initial declaration; drop bare Array.from in
_scrubTemplateExpressions (static NodeList via unapplied forEach is
an identical snapshot).
* fix: added further robustness for exotic IN_PLACE usage
test: expanded test suite accordingly
* chore: refactored the code a bit after recent IN_PLACE changes
* fix: added enhanced robustness after recent IN_PLACE audit
test: expanded the array of IN_PLACE tests accordingly
* fix: attempting to fix an issue with nodeName checks on happy-dom
* test: added happy-dom tests but just so we have them, too broken still
* fix: implemented better handling of Trusted Type policy wipes via config
* fix: further hardened the TT-related attack surface and added tests
* fix: hardened IN_PLACE a bit further against exotic elements
test: added test-coverage for IN_PLACE and DOM clobbering
* chore: decluttered the repo root for better tidiness
* chore: also moved playwright config for cleanup purposes
* chore: dropped some stale files, removed references
* fix: made the handling on shadow roots and IN_PLACE more robust
* chore: removed some of the more spammy inline comments
* test: expanded the test coverage for IN_PLACE and Shadow DOM
* Spread ALLOWED_TAGS and ALLOWED_ATTR in hooks
* Implement tests for allowlist pollution mitigation
Add tests to verify hook-driven allowlist pollution fix in DOMPurify.
* fix: made sure the hooks behavior doesn't mess up the tests
* fix: added better protection against IN_PLACE clobbering
test: expanded the test coverage even further
* test: fixed some inaccurate tests and expanded test surface
* fix: attempting to add a stronger check for cross-realm windows
* fix: removed a crash caused by the newly added cross-realm checks
---------
Co-authored-by: Mario Heiderich <[email protected]>
* Add command and commandfor attribute into allowed list
* Also add test case for command/commandfor and popovertarget/popovertargetaction
* Add selectedcontent element to allow list of tags
* fix: apply URI validation to attributes allowed via ADD_ATTR callback
The function form of ADD_ATTR (introduced in PR #1150) allowed attribute
names to bypass URI scheme validation. When the attributeCheck callback
returned true, the attribute value was accepted without checking it
against IS_ALLOWED_URI, meaning javascript: and data: URIs could pass
through unsanitized.
The array form of ADD_ATTR and the default ALLOWED_ATTR set both flow
through URI validation correctly; the function form now does too.
The fix removes the attributeCheck branch as a separate early-exit and
folds it into the name-permitted test that precedes value validation:
const nameIsPermitted =
ALLOWED_ATTR[lcName] ||
(EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function &&
EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag));
} else if (!nameIsPermitted || FORBID_ATTR[lcName]) {
Tests added: javascript: URI is stripped when href is allowed via
ADD_ATTR callback; safe https: URI is preserved.
* test: use assert.equal to avoid CodeQL substring URL warning
* chore: added stronger check for HTML Custom Element tagnames
cxhore: added stronger check for IN_PLACE tagname types
* test: add regression and pinning tests from April 2026 review
Switch rollup-plugin-typescript2 → @rollup/plugin-typescript (official,
actively maintained by the Rollup team). Type declaration pipeline is
unaffected — types are generated by tsc directly, not the rollup plugin.
Switch pre-commit → husky (modern standard, zero runtime deps, actively
maintained). Hook behavior is identical: lint + build + stage dist files.
The prepare script ensures hooks install automatically on npm install.
* test: added first scaffold for a simple data type and config fuzzer
* test: Extended the fuzzer a bit to cover the config object
* test: expanded fuzzer test coverage for bad config values
fix: fixed several crashes caused by bad config values and data types
fix: added necessary utility messages to utils.js
