Skip to content

DOMPurify 3.4.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@cure53 cure53 released this 17 May 10:35
3.4.4
This tag was signed with the committer’s verified signature.
cure53 Cure53
GPG key ID: 5F0CDACD24BB6BF4
Verified
Learn about vigilant mode.
5817ad9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • Added the selectedcontent element to default allow-list, thanks @lukewarlow
  • Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
  • Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
  • Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
  • Updated demo website and made sure it uses the latest from main
  • Updated existing workflows, fuzzer, dependabot, etc., added more tests
  • Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

Contributors

lukewarlow, fg0x0, and DEMON1A
Assets 11
Loading