Skip to content

fix(security): sanitize smuggled html in disconnected elements and check location existence - #1380

Closed
MatrixNeoKozak wants to merge 1 commit into
xdan:mainfrom
MatrixNeoKozak:fix/improvement-1783436439575
Closed

fix(security): sanitize smuggled html in disconnected elements and check location existence#1380
MatrixNeoKozak wants to merge 1 commit into
xdan:mainfrom
MatrixNeoKozak:fix/improvement-1783436439575

Conversation

@MatrixNeoKozak

Copy link
Copy Markdown

Fixes a bug where HTML elements smuggled into MathML or SVG elements were not removed during sanitization if the element was parsed inside a disconnected parser sandbox. Also adds a safety guard for location to prevent ReferenceError crashes in Server-Side Rendering (SSR) or Node.js environments.

@xdan

xdan commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Thanks — this is a real fix. The isConnected check really does miss smuggled markup when clean-html parses in a detached sandbox (useIframeSandbox: false), and switching to box.contains() catches it. Pulled it in locally with two small tweaks: the test describe block was duplicated, and the test/loader.js diff was stray, so I dropped both.

One heads-up on the test: asserting the <body> tag is gone passes in Chrome but fails in Firefox — FF keeps the smuggled node as an inert MathML-namespaced element rather than deleting it. The onload handler is stripped in both browsers, so it's safe either way, so I changed the assertion to check the handler/alert is gone, which holds cross-browser. Green in Chrome + Firefox here. This covers GHSA-rxcw-mc6f-6hr3; it'll go out in the next patch.

@xdan

xdan commented Jul 17, 2026

Copy link
Copy Markdown
Owner

Shipped in 4.13.5 (npm). I applied the box.contains() fix and the location SSR guard with a single cleaned-up test — thanks again @MatrixNeoKozak, you're credited in the changelog. This covers GHSA-rxcw-mc6f-6hr3. Closing as released.

@xdan xdan closed this Jul 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants