feat: loosened the style check a bit again

test: added correct test coverage for template scrubbing

Author: cure53

dist/purify.cjs.js

@@ -1466,13 +1466,8 @@ function createDOMPurify() {
     if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) {
       return true;
     }
-    /* Remove risky CSS construction leading to mXSS. A <style> element only
-       ever holds CSS text, so an element child is always a parser-mutation
-       signal. Not gated on HTML_NAMESPACE: declarative partial updates can
-       teleport a <style> into an <svg>/<math> foreign-content marker
-       (WICG/declarative-partial-updates), where the surviving element would
-       otherwise be SVG/MathML-namespaced and slip past an HTML-only check. */
-    if (SAFE_FOR_XML && tagName === 'style' && _isNode(currentNode.firstElementChild)) {
+    /* Remove risky CSS construction leading to mXSS */
+    if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === 'style' && _isNode(currentNode.firstElementChild)) {
       return true;
     }
     /* Remove any occurrence of processing instructions */
@@ -1633,13 +1628,14 @@ function createDOMPurify() {
        `for` is legitimate only on <label>/<output>; anywhere else (notably
        <template for>) it links the element to a patch target and teleports or
        removes an arbitrary DOM range by id/marker name. `patchsrc` fetches
-       remote markup and is treated as a script-loading mechanism (CSP). Neither
-       has a safe non-patch use, so drop them regardless of ADD_ATTR. Processing
-       instructions used as range markers are already removed by _isUnsafeNode. */
-    if (lcName === 'patchsrc') {
+       remote markup and is treated as a script-loading mechanism (CSP). Gated
+       on SAFE_FOR_XML so the removal groups with the other structural-threat
+       checks and stays overridable, consistent with the rest of the codebase.
+       PI range markers are already removed by _isUnsafeNode. */
+    if (SAFE_FOR_XML && lcName === 'patchsrc') {
       return false;
     }
-    if (lcName === 'for' && lcTag !== 'label' && lcTag !== 'output') {
+    if (SAFE_FOR_XML && lcName === 'for' && lcTag !== 'label' && lcTag !== 'output') {
       return false;
     }
     /* Make sure attribute cannot clobber */

dist/purify.cjs.js.map

@@ -1631,14 +1631,10 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       return true;
     }
 
-    /* Remove risky CSS construction leading to mXSS. A <style> element only
-       ever holds CSS text, so an element child is always a parser-mutation
-       signal. Not gated on HTML_NAMESPACE: declarative partial updates can
-       teleport a <style> into an <svg>/<math> foreign-content marker
-       (WICG/declarative-partial-updates), where the surviving element would
-       otherwise be SVG/MathML-namespaced and slip past an HTML-only check. */
+    /* Remove risky CSS construction leading to mXSS */
     if (
       SAFE_FOR_XML &&
+      currentNode.namespaceURI === HTML_NAMESPACE &&
       tagName === 'style' &&
       _isNode(currentNode.firstElementChild)
     ) {
@@ -1858,14 +1854,20 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
        `for` is legitimate only on <label>/<output>; anywhere else (notably
        <template for>) it links the element to a patch target and teleports or
        removes an arbitrary DOM range by id/marker name. `patchsrc` fetches
-       remote markup and is treated as a script-loading mechanism (CSP). Neither
-       has a safe non-patch use, so drop them regardless of ADD_ATTR. Processing
-       instructions used as range markers are already removed by _isUnsafeNode. */
-    if (lcName === 'patchsrc') {
+       remote markup and is treated as a script-loading mechanism (CSP). Gated
+       on SAFE_FOR_XML so the removal groups with the other structural-threat
+       checks and stays overridable, consistent with the rest of the codebase.
+       PI range markers are already removed by _isUnsafeNode. */
+    if (SAFE_FOR_XML && lcName === 'patchsrc') {
       return false;
     }
 
-    if (lcName === 'for' && lcTag !== 'label' && lcTag !== 'output') {
+    if (
+      SAFE_FOR_XML &&
+      lcName === 'for' &&
+      lcTag !== 'label' &&
+      lcTag !== 'output'
+    ) {
       return false;
     }
 

dist/purify.es.mjs

@@ -259,38 +259,41 @@
     // Declarative Partial Updates — patch-directive attributes
     // https://github.com/WICG/declarative-partial-updates/blob/main/patching-explainer.md
     //
-    // The proposal lets a `<template for="...">` teleport / range-replace
-    // content into a pre-existing element (by id or marker name) and lets
-    // `patchsrc` fetch remote markup (script-loading equivalent for CSP).
-    // The patch is applied on connection/stream — AFTER a parse-time
-    // sanitizer has run over a detached fragment — so these attributes must
-    // never survive sanitization. Processing-instruction range markers are
-    // already dropped by _isUnsafeNode; these tests also lock that in.
+    // <template for="..."> teleports / range-replaces content into a
+    // pre-existing element (by id or marker name); patchsrc fetches remote
+    // markup (script-loading equivalent for CSP). Patches apply on
+    // connection/stream — AFTER a parse-time sanitizer has run over a detached
+    // fragment — so these must never survive sanitization. PI range markers are
+    // already dropped by _isUnsafeNode; removal is gated on SAFE_FOR_XML. Each
+    // test uses a fresh instance so a persistent setConfig left by an earlier
+    // test cannot suppress _parseConfig and swallow the per-call config.
     // =======================================================================
 
     QUnit.module('Declarative partial updates');
 
     QUnit.test(
       'for teleport directive is stripped on non-label/output',
       (assert) => {
+        const purify = DOMPurify(window);
         assert.equal(
-          DOMPurify.sanitize('<div for="account-panel">x</div>'),
+          purify.sanitize('<div for="account-panel">x</div>'),
           '<div>x</div>'
         );
         assert.equal(
-          DOMPurify.sanitize('<section for="cart#total">$0.00</section>'),
+          purify.sanitize('<section for="cart#total">$0.00</section>'),
           '<section>$0.00</section>'
         );
       }
     );
 
     QUnit.test('for is preserved on label and output', (assert) => {
+      const purify = DOMPurify(window);
       assert.equal(
-        DOMPurify.sanitize('<label for="email">Email</label>'),
+        purify.sanitize('<label for="email">Email</label>'),
         '<label for="email">Email</label>'
       );
       assert.equal(
-        DOMPurify.sanitize('<output for="a b">42</output>', {
+        purify.sanitize('<output for="a b">42</output>', {
           ADD_TAGS: ['output'],
         }),
         '<output for="a b">42</output>'
@@ -300,39 +303,57 @@
     QUnit.test(
       'template[for] loses its patch directive when template is allowed',
       (assert) => {
+        const purify = DOMPurify(window);
         assert.contains(
-          DOMPurify.sanitize(
-            '<template for="account-panel"><b>x</b></template>',
-            {
-              ADD_TAGS: ['template'],
-            }
-          ),
+          purify.sanitize('<template for="account-panel"><b>x</b></template>', {
+            ADD_TAGS: ['template'],
+          }),
           ['<template><b>x</b></template>', '<template></template>', ''],
           'template survives but the `for` patch directive does not'
         );
       }
     );
 
     QUnit.test('patchsrc is stripped even when explicitly added', (assert) => {
+      const purify = DOMPurify(window);
       assert.equal(
-        DOMPurify.sanitize('<div patchsrc="//evil.example/p">x</div>', {
+        purify.sanitize('<div patchsrc="//evil.example/p">x</div>', {
           ADD_ATTR: ['patchsrc'],
         }),
         '<div>x</div>'
       );
     });
 
     QUnit.test('processing-instruction range markers are removed', (assert) => {
+      const purify = DOMPurify(window);
       assert.equal(
-        DOMPurify.sanitize('<section><?start name="g">hi<?end></section>'),
+        purify.sanitize('<section><?start name="g">hi<?end></section>'),
         '<section>hi</section>'
       );
       assert.equal(
-        DOMPurify.sanitize('<ul><li>a</li><?marker name="m"><li>b</li></ul>'),
+        purify.sanitize('<ul><li>a</li><?marker name="m"><li>b</li></ul>'),
         '<ul><li>a</li><li>b</li></ul>'
       );
     });
 
+    QUnit.test(
+      'SAFE_FOR_XML=false is the escape hatch for patch attributes',
+      (assert) => {
+        const purify = DOMPurify(window);
+        assert.equal(
+          purify.sanitize('<div for="target">x</div>', { SAFE_FOR_XML: false }),
+          '<div for="target">x</div>'
+        );
+        assert.equal(
+          purify.sanitize('<div patchsrc="//e">x</div>', {
+            ADD_ATTR: ['patchsrc'],
+            SAFE_FOR_XML: false,
+          }),
+          '<div patchsrc="//e">x</div>'
+        );
+      }
+    );
+
     // =======================================================================
     // Config: ALLOW_DATA_ATTR
     // =======================================================================