 Mario Heiderich
|
f39f7e89ff
|
fix: Added fixes for the jsdom parser issue in 2.x
|
2026-03-05 12:30:42 +01:00 |
|
|
Mario Heiderich
|
946f39e16b
|
fix: Added same attribute clobbering check for 2.x branch
|
2024-12-07 14:46:58 +01:00 |
|
|
Mario Heiderich
|
92e1d5534d
|
fix: Fixed two conditional bypasses discovered by @parrot409 and @Slonser
|
2024-12-06 13:09:15 +01:00 |
|
|
Mario Heiderich
|
fca087a86d
|
chore: Preparing 2.5.7 release
|
2024-09-26 12:18:18 +02:00 |
|
|
Mario Heiderich
|
a195c953c2
|
fix: Added changes to 2.x regarding attribute value checks
|
2024-06-25 14:55:33 +02:00 |
|
|
Mario Heiderich
|
6991c91ba9
|
chore: Also removed depth counter logic from 2.x branch for now
|
2024-05-27 11:54:22 +02:00 |
|
|
Mario Heiderich
|
800dc7ced0
|
fix: Added a better for for the MSIE iNaN issue
test: Added broader test support for newer Node versions to 2.x
|
2024-05-18 17:12:05 +02:00 |
|
|
Mario Heiderich
|
40bfee4eee
|
fix: Fixed an issue with MSIE and no support for Number.isNaN
|
2024-05-18 16:39:01 +02:00 |
|
|
Mario Heiderich
|
2de30daa33
|
fix: Merged prototype pollution check into 2.x
|
2024-05-11 12:17:14 +02:00 |
|
|
Mario Heiderich
|
994c49c071
|
chore: Getting 2.x branch up to date with main
|
2024-05-10 19:15:42 +02:00 |
|
|
Mario Heiderich
|
118b730185
|
fix: Added better configurability for new comment behavior
|
2024-05-07 13:06:08 +02:00 |
|
|
Mario Heiderich
|
83ef715339
|
chore: Getting 2.x branch up to date with main
|
2024-05-05 17:14:21 +02:00 |
|
|
Mario Heiderich
|
2b8536fcce
|
chore: Migrated relevant changes from main over to 2.x
|
2024-04-30 09:32:01 +02:00 |
|
|
Mario Heiderich
|
b2dca150b7
|
fix: Started to set new MAX_NESTING_DEPTH limits as well
|
2024-04-26 11:12:05 +02:00 |
|
|
Mario Heiderich
|
97e81e9142
|
test: Fixed a linter issue breaking the tests
|
2024-04-25 16:01:28 +02:00 |
|
|
Mario Heiderich
|
0c0aed17ce
|
chore: Updated 2.x branch with relevant fixes for nesting-based mXSS
|
2024-04-25 15:53:10 +02:00 |
|
|
Dr.-Ing. Mario Heiderich
|
fba5edc863
|
feature: Added SAFE_FOR_XML flag and code to 2.x branch
|
2024-04-06 17:57:01 +02:00 |
|
|
Mario Heiderich
|
f0da4063d6
|
fix: Merged relevant changes from main for 2.4.9
|
2024-03-21 10:53:15 +01:00 |
|
|
Dr.-Ing. Mario Heiderich
|
575c7b7453
|
fix: cherry-picked fixes for XML & CE bypass
|
2024-03-19 11:45:16 +01:00 |
|
|
Mario Heiderich
|
392d71f23c
|
Fix: addressed a bypass on jsdom 22 when noframes tag is allowed
|
2023-06-29 17:45:20 +02:00 |
|
|
Mario Heiderich
|
d7bdbdf92d
|
chore: preparing 2.4.5 release
|
2023-02-26 16:25:33 +01:00 |
|
|
Mario Heiderich
|
d51475bb9c
|
see #767
feat: added better check for shadowrootmod
|
2023-02-13 17:17:58 +01:00 |
|
|
Dr.-Ing. Mario Heiderich
|
4863e37b6a
|
See #761
feat: added ALLOW_SELF_CLOSE_IN_ATTR tag
test: added test case
|
2023-02-07 17:56:38 +01:00 |
|
|
Mario Heiderich
|
b5f782aafc
|
fix: Fixed a prototype pollution bug reported by @kevin_mizu
|
2023-01-05 16:32:31 +01:00 |
|
|
Tobias Smolka
|
cdd1cf2afd
|
Fix formatting
|
2022-12-19 17:05:17 +01:00 |
|
|
Tobias Smolka
|
4cc7ed1824
|
Fix Trusted Types Sink violation with empty input and NAMESPACE
|
2022-12-19 16:58:55 +01:00 |
|
|
Kevin de Youngster
|
ccd5d2b7f1
|
lint new changes
|
2022-11-08 10:48:13 -08:00 |
|
|
Tobias SmolkaandKevin de Youngster
|
35bb0c5d5d
|
Experiment with ALLOWED_NAMESPACES
|
2022-11-08 09:29:06 -08:00 |
|
|
Kevin de Youngster
|
d68bb02012
|
add tests for ADD_NAMESPACES
|
2022-11-07 15:21:42 -08:00 |
|
|
Kevin de Youngster
|
b647887879
|
add ADD_NAMESPACES config
|
2022-11-03 16:02:51 -07:00 |
|
|
Mario Heiderich
|
6d7a88a7a0
|
feat: expanded detection for template literals in SAFE_FOR_TEMPLATES
|
2022-10-25 11:18:38 +02:00 |
|
|
Mario Heiderich
|
3732ecfcaf
|
fix: Fixed an exception caused by DOM Clobbering, thanks Masato
|
2022-09-02 13:17:24 +02:00 |
|
|
Mario Heiderich
|
ddff426b88
|
See #712
fix: marked cfg for sanitize() as optional / default param
|
2022-08-23 16:50:31 +02:00 |
|
|
Soheil Khodayari
|
7963df7e94
|
Extra DOM Clobbering protection via SANITIZE_NAMED_PROPS config
|
2022-08-16 20:05:33 +02:00 |
|
|
Tobias Smolka
|
98997bceda
|
Support sanitization of attributes that require Trusted Types
|
2022-07-18 14:12:37 +02:00 |
|
|
Mario Heiderich
|
542feafa14
|
See #692
fix: disable colliding linter rule
|
2022-06-06 14:02:16 +02:00 |
|
|
Tobias Smolka
|
1e169cf338
|
Make TAG and ATTR cfg options case-sensitive when parsing XHTML
|
2022-06-06 13:30:12 +02:00 |
|
|
Mario Heiderich
|
53cb0e9a9b
|
fix: Added an experimental fix for a WebKit engine bug, thanks @sybrew
|
2022-05-11 17:43:51 +02:00 |
|
|
Ben Tran
|
12474fa505
|
Capitalised const variable name
|
2022-05-11 15:20:26 +09:30 |
|
|
Ben Tran
|
b5b95bedb8
|
Moved commonSvgAndHTMLElements out so _checkValidNamespace doesn't re-created in every call
|
2022-05-11 14:11:03 +09:30 |
|
|
Ben Tran
|
598b1fb5d8
|
Minor performance improvements
|
2022-05-11 13:38:21 +09:30 |
|
|
Issei Horie
|
af9f0dc598
|
chore: fix typo
|
2022-05-07 00:35:56 +09:00 |
|
|
Cure53andGitHub
|
7de8d43bac
|
Merge branch 'main' into main
|
2022-03-07 09:28:35 +01:00 |
|
|
Issei Horie
|
0dde8c52bc
|
return removed hook
|
2022-03-06 20:42:14 +09:00 |
|
|
Mario Heiderich
|
4fcc93352c
|
chore: added missing eslint exception
|
2022-02-15 15:00:53 +01:00 |
|
|
Tobias Smolka
|
ab3335ad33
|
Fix lint error
|
2022-02-14 10:41:50 +01:00 |
|
|
Tobias Smolka
|
7b85b95284
|
Merge branch 'main' of https://github.com/cure53/DOMPurify into tosmolka/fix-doctype
|
2022-02-14 10:40:32 +01:00 |
|
|
Tobias Smolka
|
a353573916
|
Allow only html doctype
|
2022-02-14 10:30:54 +01:00 |
|
|
Mario Heiderich
|
6426a88f14
|
chore: added a missing eslint-disable-next-line comment
|
2022-02-12 15:59:41 +01:00 |
|
|
Mario Heiderich
|
c490bb02e1
|
See #645
fix: Addressed an issue with improper content cloning for custom
elements
|
2022-02-12 15:26:49 +01:00 |
|