You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes a bug where HTML elements smuggled into MathML or SVG elements were not removed during sanitization if the element was parsed inside a disconnected parser sandbox. Also adds a safety guard for location to prevent ReferenceError crashes in Server-Side Rendering (SSR) or Node.js environments.
Thanks — this is a real fix. The isConnected check really does miss smuggled markup when clean-html parses in a detached sandbox (useIframeSandbox: false), and switching to box.contains() catches it. Pulled it in locally with two small tweaks: the test describe block was duplicated, and the test/loader.js diff was stray, so I dropped both.
One heads-up on the test: asserting the <body> tag is gone passes in Chrome but fails in Firefox — FF keeps the smuggled node as an inert MathML-namespaced element rather than deleting it. The onload handler is stripped in both browsers, so it's safe either way, so I changed the assertion to check the handler/alert is gone, which holds cross-browser. Green in Chrome + Firefox here. This covers GHSA-rxcw-mc6f-6hr3; it'll go out in the next patch.
Shipped in 4.13.5 (npm). I applied the box.contains() fix and the location SSR guard with a single cleaned-up test — thanks again @MatrixNeoKozak, you're credited in the changelog. This covers GHSA-rxcw-mc6f-6hr3. Closing as released.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes a bug where HTML elements smuggled into MathML or SVG elements were not removed during sanitization if the element was parsed inside a disconnected parser sandbox. Also adds a safety guard for
locationto preventReferenceErrorcrashes in Server-Side Rendering (SSR) or Node.js environments.