fix: Addressed a possible bypass issue caused by deep-nesting

cure53 · Apr 23, 2024 · c5369f2 · c5369f2
1 parent 632f122
commit c5369f2
Show file tree

Hide file tree

Showing 9 changed files with 61 additions and 5 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -515,6 +515,9 @@ function createDOMPurify() {
   /* Keep a reference to config to pass to hooks */
   let CONFIG = null;
 
+  /* Specify the maximum element nesting depth to prevent mXSS */
+  const MAX_NESTING_DEPTH = 511;
+
   /* Ideally, do not touch anything below this line */
   /* ______________________________________________ */
 
@@ -1283,6 +1286,7 @@ function createDOMPurify() {
     let importedNode = null;
     let currentNode = null;
     let returnNode = null;
+    let depth = 0;
     /* Make sure we have a string to sanitize.
       DO NOT return early, as this will return the wrong type if
       the user has requested a DOM object rather than a string */
@@ -1374,6 +1378,16 @@ function createDOMPurify() {
         continue;
       }
 
+      /* Count the nesting depth of an element */
+      if (currentNode.hasChildNodes()) {
+        depth++;
+      }
+
+      /* Remove an element if nested too deeply to avoid mXSS */
+      if (depth >= MAX_NESTING_DEPTH) {
+        _forceRemove(currentNode);
+      }
+
       /* Shadow DOM detected, sanitize it */
       if (currentNode.content instanceof DocumentFragment) {
         _sanitizeShadowDOM(currentNode.content);

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -388,6 +388,9 @@ function createDOMPurify(window = getGlobal()) {
   /* Keep a reference to config to pass to hooks */
   let CONFIG = null;
 
+  /* Specify the maximum element nesting depth to prevent mXSS */
+  const MAX_NESTING_DEPTH = 511;
+
   /* Ideally, do not touch anything below this line */
   /* ______________________________________________ */
 
@@ -1397,6 +1400,7 @@ function createDOMPurify(window = getGlobal()) {
     let importedNode = null;
     let currentNode = null;
     let returnNode = null;
+    let depth = 0;
     /* Make sure we have a string to sanitize.
       DO NOT return early, as this will return the wrong type if
       the user has requested a DOM object rather than a string */
@@ -1497,6 +1501,16 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
+      /* Count the nesting depth of an element */
+      if (currentNode.hasChildNodes()) {
+        depth++;
+      }
+
+      /* Remove an element if nested too deeply to avoid mXSS */
+      if (depth >= MAX_NESTING_DEPTH) {
+        _forceRemove(currentNode);
+      }
+
       /* Shadow DOM detected, sanitize it */
       if (currentNode.content instanceof DocumentFragment) {
         _sanitizeShadowDOM(currentNode.content);