chore: Getting 2.x branch up to date with main

cure53 · May 5, 2024 · b81a576 · b81a576
1 parent d299fcc
commit b81a576
Show file tree

Hide file tree

Showing 11 changed files with 63 additions and 19 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1126,7 +1126,10 @@ function createDOMPurify(window = getGlobal()) {
     if (
       SANITIZE_DOM &&
       (lcName === 'id' || lcName === 'name') &&
-      (value in document || value in formElement)
+      (value in document ||
+        value in formElement ||
+        value === '__depth' ||
+        value === '__removalCount')
     ) {
       return false;
     }
@@ -1285,6 +1288,12 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
+      /* Work around a security issue with comments inside attribites */
+      if (regExpTest(/(--!?|])>/i, value)) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
+
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
         value = stringReplace(value, MUSTACHE_EXPR, ' ');
@@ -1345,7 +1354,11 @@ function createDOMPurify(window = getGlobal()) {
           currentNode.setAttribute(name, value);
         }
 
-        arrayPop(DOMPurify.removed);
+        if (_isClobbered(currentNode)) {
+          _forceRemove(currentNode);
+        } else {
+          arrayPop(DOMPurify.removed);
+        }
       } catch (_) {}
     }
 

diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
@@ -458,6 +458,7 @@ module.exports = [
   }, {
       "payload": "<![><img src=\"]><img src=x onerror=alert(39)//\">",
       "expected": [
+          "<img>",
           "<img src=\"]&gt;&lt;img src=x onerror=alert(39)//\">",
           "<img src=\"]><img src=x onerror=alert(39)//\">",
           "<img src=\"]%3E%3Cimg%20src=x%20onerror=alert%2839%29//\">"

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -2131,15 +2131,15 @@
       let dirty = `<form><input name="__depth">${`<div>`.repeat(500)}${`</div>`.repeat(500)}<img>`;
       let expected = [
           ``,
-          `<form><input name="__depth">${`<div>`.repeat(252)}${`</div>`.repeat(252)}<img></form>`,
+          `<form><input>${`<div>`.repeat(252)}${`</div>`.repeat(252)}<img></form>`,
       ];
       let clean = DOMPurify.sanitize(dirty);
       assert.contains(clean, expected);
 
       dirty = `<form><input name="__depth"></form>${`<div>`.repeat(500)}${`</div>`.repeat(500)}<img>`;
       expected = [
           `${`<div>`.repeat(253)}${`</div>`.repeat(253)}<img>`,
-          `<form><input name="__depth"></form>${`<div>`.repeat(253)}${`</div>`.repeat(253)}<img>`
+          `<form><input></form>${`<div>`.repeat(253)}${`</div>`.repeat(253)}<img>`
       ];
       clean = DOMPurify.sanitize(dirty);
       assert.contains(clean, expected);
@@ -2149,7 +2149,7 @@
       )}${`</div>`.repeat(500)}<img>`;
       expected = [
         ``,
-        `<form><input name="__removalCount">${`<div>`.repeat(
+        `<form><input>${`<div>`.repeat(
           252
         )}${`</div>`.repeat(252)}<img></form>`,
       ];
@@ -2161,7 +2161,7 @@
       )}${`</div>`.repeat(500)}<img>`;
       expected = [
         `${`<div>`.repeat(253)}${`</div>`.repeat(253)}<img>`,
-        `<form><input name="__removalCount"></form>${`<div>`.repeat(
+        `<form><input></form>${`<div>`.repeat(
           253
         )}${`</div>`.repeat(253)}<img>`,
       ];
@@ -2172,12 +2172,12 @@
     QUnit.test('Test proper handling of nesting-based mXSS 3/3', function (assert) {
 
       let dirty = `<form><input name="__depth">`;
-      let expected = [``, `<form><input name="__depth"></form>`];
+      let expected = [``, `<form><input></form>`];
       let clean = DOMPurify.sanitize(dirty);
       assert.contains(clean, expected);
 
       dirty = `<form><input name="__removalCount">`;
-      expected = [``, `<form><input name="__removalCount"></form>`];
+      expected = [``, `<form><input></form>`];
       clean = DOMPurify.sanitize(dirty);
       assert.contains(clean, expected);
     });