Update dependency dompurify to v2.0.17 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	2.0.7 -> 2.0.17

GitHub Vulnerability Alerts

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

---

Release Notes

cure53/DOMPurify (dompurify)

v2.0.17: DOMPurify 2.0.17

Compare Source

• Fixed another bypass causing mXSS by using MathML

v2.0.16: DOMPurify 2.0.16

Compare Source

• Fixed an mXSS-based bypass caused by nested forms inside MathML
• Fixed a security error thrown on older Chrome on Android versions, see #​470

Credits for the bypass go to Michał Bentkowski (@​securityMB) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix 🙇‍♂️ 🙇‍♀️

v2.0.15: DOMPurify 2.0.15

Compare Source

• Added a renovated test suite, thanks @​peernohell
• Fixed some minor linter warnings

v2.0.14: DOMPurify 2.0.14

Compare Source

• Fixed a problem with the documentMode default value

v2.0.13

Compare Source

v2.0.12: DOMPurify 2.0.12

Compare Source

• Fixed a minor bug when working with Trusted Types
• Fixed some typos in a demo file
• Fixed some wordings in code and docs

v2.0.11: DOMPurify 2.0.11

Compare Source

• Fixed faulty behavior for non breaking space characters
• Added ADD_DATA_URI_TAGS directive to allow customizing Data URI tag behavior

v2.0.10: DOMPurify 2.0.10

Compare Source

• Fixed a dependency problem causing builds to break
• Fixed a test in Chrome 83 covering Trusted Types

v2.0.9: DOMPurify 2.0.9

Compare Source

• Removed a meanwhile useless parser check
• Added countless new attributes to whitelist
• Added whole new build and system
• Added license tag to compressed files
• Updated README for more clarity

v2.0.8: DOMPurify 2.0.8

Compare Source

• Fixed a bypass that can be abused in case SAFE_FOR_JQUERY is used with jQuery 3.x, thanks @​masatokinugawa 🙇‍♀️
• Added new elements to whitelist, thanks @​chris-morgan
• Added first layer of prototype poisoning protection, thanks @​dejang
• Added better controls for uponSanitizeAttribute, thanks @​devinrhode2
• Added demo for node removal, thanks @​mikesnare

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.