@ionic/core 8.8.12-dev.11782342444.186b6e9c → 8.8.12-dev.11782931922.18ba507c

package/dist/cjs/{index-C147NqgL.js → index-Cueg3U4w.js}

@@ -9,13 +9,17 @@ var index = require('./index-Ct7gcRif.js');
  * Sanitize an untrusted HTML string.
  *
  * Parses the string into a detached DOM, removes blocked tags, strips
- * attributes outside the `allowedAttributes` list (refer `sanitizeElement`),
- * and scrubs script-scheme URLs. Returns the sanitized HTML string.
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
  *
  * Use this when you have an HTML string from an unknown source and need to
  * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
  * have a DOM tree and want to sanitize it in place without a string round
- * trip; both apply the same attribute policy.
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
  *
  * @param untrustedString - The HTML string to sanitize. Pass an
  * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
@@ -71,7 +75,7 @@ const sanitizeDOMString = (untrustedString) => {
                 const childElements = getElementChildren(element);
                 /* eslint-disable-next-line */
                 for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
-                    sanitizeElement(childElements[childIndex]);
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
                 }
             }
         });
@@ -83,7 +87,7 @@ const sanitizeDOMString = (untrustedString) => {
         const dfChildren = getElementChildren(documentFragment);
         /* eslint-disable-next-line */
         for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
-            sanitizeElement(dfChildren[childIndex]);
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
         }
         // Append document fragment to div
         const fragmentDiv = document.createElement('div');
@@ -101,8 +105,8 @@ const sanitizeDOMString = (untrustedString) => {
  * Sanitize an entire trusted DOM tree in place.
  *
  * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
- * then sanitizes attributes on every remaining element using the same
- * allowlist policy as `sanitizeDOMString` (refer `sanitizeElement`).
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
  * Component presentational attributes (`size`, `color`, `shape`, inline
  * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
  * form/navigation-hijack attributes, script-scheme URLs, and non-image
@@ -125,7 +129,7 @@ const sanitizeDOMTree = (root) => {
             matches[i].remove();
         }
     });
-    sanitizeElement(root);
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
 };
 /**
  * Clean up current element based on allowed attributes
@@ -133,7 +137,7 @@ const sanitizeDOMTree = (root) => {
  * clean those up as well
  */
 // TODO(FW-2832): type (using Element triggers other type errors as well)
-const sanitizeElement = (element) => {
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
     // IE uses childNodes, so ignore nodes that are not elements
     if (element.nodeType && element.nodeType !== 1) {
         return;
@@ -166,7 +170,7 @@ const sanitizeElement = (element) => {
          * (`formaction`, `action`, `target`), namespaced attributes like
          * `xlink:href`, and anything else not explicitly known to be safe.
          */
-        if (!isAttributeAllowed(lowerName)) {
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
             element.removeAttribute(attributeName);
             continue;
         }
@@ -209,7 +213,7 @@ const sanitizeElement = (element) => {
     const childElements = getElementChildren(element);
     /* eslint-disable-next-line */
     for (let i = 0; i < childElements.length; i++) {
-        sanitizeElement(childElements[i]);
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
     }
 };
 /**
@@ -269,13 +273,24 @@ const reflectPropertiesToAttributes = (root) => {
     }
 };
 /**
- * Attribute names that are always safe to keep. Covers global HTML
- * attributes, the Ionic component presentational props that cloned rich
- * content (e.g. `ion-select-option` markup) relies on, and the inert SVG
- * presentation attributes used by inline icons.
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
  *
  * `aria-*` and `data-*` are allowed separately by prefix (refer
- * `allowedAttributePrefixes`) since they are inert and not worth
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
  * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
  * their values are still scrubbed for script schemes in `sanitizeElement`.
  *
@@ -283,7 +298,7 @@ const reflectPropertiesToAttributes = (root) => {
  * form/navigation-hijack attributes (`formaction`, `action`, `target`),
  * which are therefore stripped.
  */
-const allowedAttributes = [
+const richContentAllowedAttributes = [
     // Global / structural
     'class',
     'id',
@@ -347,16 +362,16 @@ const allowedAttributes = [
     'opacity',
 ];
 /**
- * Attribute-name prefixes that are always safe to keep. `aria-*` and
- * `data-*` attributes cannot execute script or load resources, so they are
- * allowed wholesale rather than enumerated by name.
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
  */
-const allowedAttributePrefixes = ['aria-', 'data-'];
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
 /**
  * Whether an attribute name (already lowercased) is safe to keep, by exact
  * match or by an allowed prefix.
  */
-const isAttributeAllowed = (lowerName) => {
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
     if (allowedAttributes.includes(lowerName)) {
         return true;
     }

package/dist/cjs/index.cjs.js

@@ -12,7 +12,7 @@ var index$1 = require('./index-CAvQ7Tka.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var helpers = require('./helpers-Cv23MFHM.js');
 var index$2 = require('./index-Ct7gcRif.js');
-var index$3 = require('./index-C147NqgL.js');
+var index$3 = require('./index-Cueg3U4w.js');
 var config = require('./config-DWdFbSNK.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var index$4 = require('./index-aC4x3Fk3.js');

package/dist/cjs/ion-action-sheet.cjs.entry.js

@@ -8,7 +8,7 @@ var buttonActive = require('./button-active-0mPOKmV2.js');
 var helpers = require('./helpers-Cv23MFHM.js');
 var lockController = require('./lock-controller-aDB9wrEf.js');
 var overlays = require('./overlays-DSmSrd_4.js');
-var selectOptionRender = require('./select-option-render-BUmJxlqW.js');
+var selectOptionRender = require('./select-option-render-DTF50t5r.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var animation = require('./animation-BJq0kcy2.js');
@@ -19,7 +19,7 @@ require('./index-CAvQ7Tka.js');
 require('./gesture-controller-dtqlP_q4.js');
 require('./hardware-back-button-iUuF_76h.js');
 require('./framework-delegate-BtICZDHr.js');
-require('./index-C147NqgL.js');
+require('./index-Cueg3U4w.js');
 
 /**
  * iOS Action Sheet Enter Animation

package/dist/cjs/ion-alert.cjs.entry.js

@@ -10,8 +10,8 @@ var helpers = require('./helpers-Cv23MFHM.js');
 var lockController = require('./lock-controller-aDB9wrEf.js');
 var overlayControlLabel = require('./overlay-control-label-D2sdL2O8.js');
 var overlays = require('./overlays-DSmSrd_4.js');
-var index$1 = require('./index-C147NqgL.js');
-var selectOptionRender = require('./select-option-render-BUmJxlqW.js');
+var index$1 = require('./index-Cueg3U4w.js');
+var selectOptionRender = require('./select-option-render-DTF50t5r.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var animation = require('./animation-BJq0kcy2.js');

package/dist/cjs/ion-infinite-scroll_2.cjs.entry.js

@@ -7,7 +7,7 @@ var index = require('./index-Ct7gcRif.js');
 var index$1 = require('./index-CIrkNXqJ.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var config = require('./config-DWdFbSNK.js');
-var index$2 = require('./index-C147NqgL.js');
+var index$2 = require('./index-Cueg3U4w.js');
 require('./helpers-Cv23MFHM.js');
 
 const infiniteScrollCss = () => `ion-infinite-scroll{display:none;width:100%}.infinite-scroll-enabled{display:block}`;

package/dist/cjs/ion-loading.cjs.entry.js

@@ -8,7 +8,7 @@ var config = require('./config-DWdFbSNK.js');
 var helpers = require('./helpers-Cv23MFHM.js');
 var lockController = require('./lock-controller-aDB9wrEf.js');
 var overlays = require('./overlays-DSmSrd_4.js');
-var index$1 = require('./index-C147NqgL.js');
+var index$1 = require('./index-Cueg3U4w.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var animation = require('./animation-BJq0kcy2.js');

package/dist/cjs/ion-refresher_2.cjs.entry.js

@@ -11,7 +11,7 @@ var haptic = require('./haptic-ClPPQ_PS.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var animation = require('./animation-BJq0kcy2.js');
 var config = require('./config-DWdFbSNK.js');
-var index$3 = require('./index-C147NqgL.js');
+var index$3 = require('./index-Cueg3U4w.js');
 var index$2 = require('./index-DqmRDbxg.js');
 var spinnerConfigs = require('./spinner-configs-DxHKnd3-.js');
 require('./capacitor-DmA66EwP.js');

package/dist/cjs/ion-select-modal.cjs.entry.js

@@ -7,14 +7,14 @@ var index = require('./index-Ct7gcRif.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var overlayControlLabel = require('./overlay-control-label-D2sdL2O8.js');
 var overlays = require('./overlays-DSmSrd_4.js');
-var selectOptionRender = require('./select-option-render-BUmJxlqW.js');
+var selectOptionRender = require('./select-option-render-DTF50t5r.js');
 var theme = require('./theme-CeDs6Hcv.js');
 require('./index-DkNv4J_i.js');
 require('./helpers-Cv23MFHM.js');
 require('./hardware-back-button-iUuF_76h.js');
 require('./framework-delegate-BtICZDHr.js');
 require('./gesture-controller-dtqlP_q4.js');
-require('./index-C147NqgL.js');
+require('./index-Cueg3U4w.js');
 
 const ionicSelectModalMdCss = () => `.action-sheet-button-label-has-rich-content.sc-ion-select-modal-ionic,.alert-radio-label-has-rich-content.sc-ion-select-modal-ionic,.alert-checkbox-label-has-rich-content.sc-ion-select-modal-ionic,.select-option-label-has-rich-content.sc-ion-select-modal-ionic{display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;gap:16px}.action-sheet-button-label-has-rich-content.sc-ion-select-modal-ionic,.alert-radio-label-has-rich-content.sc-ion-select-modal-ionic,.alert-checkbox-label-has-rich-content.sc-ion-select-modal-ionic,.select-option-content.sc-ion-select-modal-ionic{-ms-flex:1;flex:1}.action-sheet-button-label-text.sc-ion-select-modal-ionic,.alert-checkbox-label-text.sc-ion-select-modal-ionic,.alert-radio-label-text.sc-ion-select-modal-ionic,.select-option-label-text.sc-ion-select-modal-ionic{display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;gap:12px}.select-option-start.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic{display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;gap:8px}.select-option-description.sc-ion-select-modal-ionic{padding-left:0;padding-right:0;padding-top:5px;padding-bottom:0;display:block;color:var(--ion-color-step-700, var(--ion-text-color-step-300, #4d4d4d));font-size:0.75rem}.select-option-label.sc-ion-select-modal-ionic:not(.select-option-label-has-rich-content){text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.select-option-label-has-rich-content.sc-ion-select-modal-ionic{display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center}ion-radio.select-option-has-rich-content.sc-ion-select-modal-ionic::part(label),ion-radio.select-option-has-rich-content.sc-ion-select-modal-ionic [part~="label"],ion-checkbox.select-option-has-rich-content.sc-ion-select-modal-ionic::part(label),ion-checkbox.select-option-has-rich-content.sc-ion-select-modal-ionic [part~="label"],.select-option-content.sc-ion-select-modal-ionic{-ms-flex:1;flex:1;white-space:normal}.select-option-start.sc-ion-select-modal-ionic>ion-avatar.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>ion-avatar.sc-ion-select-modal-ionic{width:40px;height:40px}.select-option-start.sc-ion-select-modal-ionic>ion-icon.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>ion-icon.sc-ion-select-modal-ionic{width:24px;height:24px}.select-option-start.sc-ion-select-modal-ionic>ion-img.sc-ion-select-modal-ionic,.select-option-start.sc-ion-select-modal-ionic>img.sc-ion-select-modal-ionic,.select-option-start.sc-ion-select-modal-ionic>svg.sc-ion-select-modal-ionic,.select-option-start.sc-ion-select-modal-ionic>ion-thumbnail.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>ion-img.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>img.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>svg.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>ion-thumbnail.sc-ion-select-modal-ionic{width:56px;height:56px}.select-option-start.sc-ion-select-modal-ionic>video.sc-ion-select-modal-ionic,.select-option-end.sc-ion-select-modal-ionic>video.sc-ion-select-modal-ionic{width:114px;height:56px}.sc-ion-select-modal-ionic-h{height:100%}ion-list.sc-ion-select-modal-ionic ion-radio.sc-ion-select-modal-ionic::part(container),ion-list.sc-ion-select-modal-ionic ion-radio.sc-ion-select-modal-ionic [part~="container"]{display:none}ion-list.sc-ion-select-modal-ionic ion-radio.sc-ion-select-modal-ionic::part(label),ion-list.sc-ion-select-modal-ionic ion-radio.sc-ion-select-modal-ionic [part~="label"]{margin-left:0;margin-right:0;margin-top:0;margin-bottom:0}ion-item.sc-ion-select-modal-ionic{--inner-border-width:0}.item-radio-checked.sc-ion-select-modal-ionic{--background:rgba(var(--ion-color-primary-rgb, 0, 84, 233), 0.08);--background-focused:var(--ion-color-primary, #0054e9);--background-focused-opacity:0.2;--background-hover:var(--ion-color-primary, #0054e9);--background-hover-opacity:0.12}.item-checkbox-checked.sc-ion-select-modal-ionic{--background-activated:var(--ion-item-color, var(--ion-text-color, #000));--background-focused:var(--ion-item-color, var(--ion-text-color, #000));--background-hover:var(--ion-item-color, var(--ion-text-color, #000));--color:var(--ion-color-primary, #0054e9)}`;
 

package/dist/cjs/ion-select_3.cjs.entry.js

@@ -11,13 +11,13 @@ var validity = require('./validity-BpS37YFM.js');
 var helpers = require('./helpers-Cv23MFHM.js');
 var overlays = require('./overlays-DSmSrd_4.js');
 var dir = require('./dir-Cn0z1rJH.js');
-var index$2 = require('./index-C147NqgL.js');
+var index$2 = require('./index-Cueg3U4w.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var watchOptions = require('./watch-options-CviOsrTS.js');
 var index$1 = require('./index-DqmRDbxg.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var overlayControlLabel = require('./overlay-control-label-D2sdL2O8.js');
-var selectOptionRender = require('./select-option-render-BUmJxlqW.js');
+var selectOptionRender = require('./select-option-render-DTF50t5r.js');
 require('./index-DkNv4J_i.js');
 require('./hardware-back-button-iUuF_76h.js');
 require('./framework-delegate-BtICZDHr.js');
@@ -1181,12 +1181,12 @@ const SelectOption = class {
         index.registerInstance(this, hostRef);
         this.inputId = `ion-selopt-${selectOptionIds++}`;
         /**
-         * If `true`, the user cannot interact with the select option. This property does not apply when `interface="action-sheet"` as `ion-action-sheet` does not allow for disabled buttons.
+         * If `true`, the user cannot interact with the select option.
          */
         this.disabled = false;
     }
     render() {
-        return index.h(index.Host, { key: '4f284411b91b98eda59aadc401bc4d8e423caae9', role: "option", id: this.inputId, class: ionicGlobal.getIonMode(this) });
+        return index.h(index.Host, { key: '8b8bef0f5a55f18048708c34d3ea3ff0ff2f1d47', role: "option", id: this.inputId, class: ionicGlobal.getIonMode(this) });
     }
     get el() { return index.getElement(this); }
 };

package/dist/cjs/ion-toast.cjs.entry.js

@@ -8,7 +8,7 @@ var config = require('./config-DWdFbSNK.js');
 var helpers = require('./helpers-Cv23MFHM.js');
 var lockController = require('./lock-controller-aDB9wrEf.js');
 var overlays = require('./overlays-DSmSrd_4.js');
-var index$3 = require('./index-C147NqgL.js');
+var index$3 = require('./index-Cueg3U4w.js');
 var theme = require('./theme-CeDs6Hcv.js');
 var ionicGlobal = require('./ionic-global-B-cA6LkY.js');
 var animation = require('./animation-BJq0kcy2.js');

package/dist/cjs/{select-option-render-BUmJxlqW.js → select-option-render-DTF50t5r.js}

@@ -4,7 +4,7 @@
 'use strict';
 
 var index = require('./index-Ct7gcRif.js');
-var index$1 = require('./index-C147NqgL.js');
+var index$1 = require('./index-Cueg3U4w.js');
 
 /**
  * Converts a DOM node into a Stencil VNode (or text string) so the
@@ -75,6 +75,14 @@ const cloneToVNode = (node, keyPrefix, index$1) => {
 const renderClonedContent = (id, content, className, useSpan = false) => {
     const Tag = useSpan ? 'span' : 'div';
     const keyPrefix = `${className}-${id}`;
+    /**
+     * Do not remove. This is the only sanitization pass for callers that pass
+     * an `HTMLElement` straight to `renderOptionLabel` (e.g. vanilla JS)
+     * without going through `getOptionContent`, which sanitizes upstream.
+     * `cloneToVNode` does pure structural conversion and no security
+     * filtering, so dropping this call would reopen an XSS hole on the
+     * direct `HTMLElement` path.
+     */
     index$1.sanitizeDOMTree(content);
     return (index.h(Tag, { class: className, key: keyPrefix }, Array.from(content.childNodes).map((child, i) => cloneToVNode(child, keyPrefix, i))));
 };

package/dist/collection/components/select-option/select-option.js

@@ -14,12 +14,12 @@ export class SelectOption {
     constructor() {
         this.inputId = `ion-selopt-${selectOptionIds++}`;
         /**
-         * If `true`, the user cannot interact with the select option. This property does not apply when `interface="action-sheet"` as `ion-action-sheet` does not allow for disabled buttons.
+         * If `true`, the user cannot interact with the select option.
          */
         this.disabled = false;
     }
     render() {
-        return h(Host, { key: '4f284411b91b98eda59aadc401bc4d8e423caae9', role: "option", id: this.inputId, class: getIonMode(this) });
+        return h(Host, { key: '8b8bef0f5a55f18048708c34d3ea3ff0ff2f1d47', role: "option", id: this.inputId, class: getIonMode(this) });
     }
     static get is() { return "ion-select-option"; }
     static get encapsulation() { return "shadow"; }
@@ -47,7 +47,7 @@ export class SelectOption {
                 "optional": false,
                 "docs": {
                     "tags": [],
-                    "text": "If `true`, the user cannot interact with the select option. This property does not apply when `interface=\"action-sheet\"` as `ion-action-sheet` does not allow for disabled buttons."
+                    "text": "If `true`, the user cannot interact with the select option."
                 },
                 "getter": false,
                 "setter": false,

package/dist/collection/utils/sanitization/index.js

@@ -6,13 +6,17 @@ import { printIonError } from "../logging/index";
  * Sanitize an untrusted HTML string.
  *
  * Parses the string into a detached DOM, removes blocked tags, strips
- * attributes outside the `allowedAttributes` list (refer `sanitizeElement`),
- * and scrubs script-scheme URLs. Returns the sanitized HTML string.
+ * attributes outside the narrow `domStringAllowedAttributes` list (refer
+ * `sanitizeElement`), and scrubs script-scheme URLs. Returns the sanitized
+ * HTML string.
  *
  * Use this when you have an HTML string from an unknown source and need to
  * render it via `innerHTML`. Use `sanitizeDOMTree` instead when you already
  * have a DOM tree and want to sanitize it in place without a string round
- * trip; both apply the same attribute policy.
+ * trip. The two apply the same dangerous-vector scrubbing but different
+ * attribute allowlists: this path stays narrow so existing consumers
+ * (toast, loading, alert message, etc.) are unaffected, while
+ * `sanitizeDOMTree` uses the wider rich-content allowlist.
  *
  * @param untrustedString - The HTML string to sanitize. Pass an
  * `IonicSafeString` to bypass sanitization, or `undefined` to short-circuit.
@@ -68,7 +72,7 @@ export const sanitizeDOMString = (untrustedString) => {
                 const childElements = getElementChildren(element);
                 /* eslint-disable-next-line */
                 for (let childIndex = 0; childIndex < childElements.length; childIndex++) {
-                    sanitizeElement(childElements[childIndex]);
+                    sanitizeElement(childElements[childIndex], domStringAllowedAttributes);
                 }
             }
         });
@@ -80,7 +84,7 @@ export const sanitizeDOMString = (untrustedString) => {
         const dfChildren = getElementChildren(documentFragment);
         /* eslint-disable-next-line */
         for (let childIndex = 0; childIndex < dfChildren.length; childIndex++) {
-            sanitizeElement(dfChildren[childIndex]);
+            sanitizeElement(dfChildren[childIndex], domStringAllowedAttributes);
         }
         // Append document fragment to div
         const fragmentDiv = document.createElement('div');
@@ -98,8 +102,8 @@ export const sanitizeDOMString = (untrustedString) => {
  * Sanitize an entire trusted DOM tree in place.
  *
  * Removes blocked tags (`script`, `iframe`, etc.) from the subtree and
- * then sanitizes attributes on every remaining element using the same
- * allowlist policy as `sanitizeDOMString` (refer `sanitizeElement`).
+ * then sanitizes attributes on every remaining element using the wider
+ * `richContentAllowedAttributes` allowlist (refer `sanitizeElement`).
  * Component presentational attributes (`size`, `color`, `shape`, inline
  * SVG, `aria-*`, `data-*`) are preserved; `style`, event handlers (`on*`),
  * form/navigation-hijack attributes, script-scheme URLs, and non-image
@@ -122,7 +126,7 @@ export const sanitizeDOMTree = (root) => {
             matches[i].remove();
         }
     });
-    sanitizeElement(root);
+    sanitizeElement(root, richContentAllowedAttributes, richContentAllowedAttributePrefixes);
 };
 /**
  * Clean up current element based on allowed attributes
@@ -130,7 +134,7 @@ export const sanitizeDOMTree = (root) => {
  * clean those up as well
  */
 // TODO(FW-2832): type (using Element triggers other type errors as well)
-const sanitizeElement = (element) => {
+const sanitizeElement = (element, allowedAttributes, allowedAttributePrefixes = []) => {
     // IE uses childNodes, so ignore nodes that are not elements
     if (element.nodeType && element.nodeType !== 1) {
         return;
@@ -163,7 +167,7 @@ const sanitizeElement = (element) => {
          * (`formaction`, `action`, `target`), namespaced attributes like
          * `xlink:href`, and anything else not explicitly known to be safe.
          */
-        if (!isAttributeAllowed(lowerName)) {
+        if (!isAttributeAllowed(lowerName, allowedAttributes, allowedAttributePrefixes)) {
             element.removeAttribute(attributeName);
             continue;
         }
@@ -206,7 +210,7 @@ const sanitizeElement = (element) => {
     const childElements = getElementChildren(element);
     /* eslint-disable-next-line */
     for (let i = 0; i < childElements.length; i++) {
-        sanitizeElement(childElements[i]);
+        sanitizeElement(childElements[i], allowedAttributes, allowedAttributePrefixes);
     }
 };
 /**
@@ -266,13 +270,24 @@ export const reflectPropertiesToAttributes = (root) => {
     }
 };
 /**
- * Attribute names that are always safe to keep. Covers global HTML
- * attributes, the Ionic component presentational props that cloned rich
- * content (e.g. `ion-select-option` markup) relies on, and the inert SVG
- * presentation attributes used by inline icons.
+ * Attribute allowlist for `sanitizeDOMString`. Intentionally narrow: this
+ * path sanitizes developer HTML strings rendered via `innerHTML` by
+ * `ion-toast`, `ion-loading`, the `ion-alert` message,
+ * `ion-refresher-content`, and `ion-infinite-scroll-content`, so the list
+ * is kept to the minimum those have always needed. Broadening it here would
+ * change sanitization output for all of those consumers, so the wider
+ * rich-content allowlist below is deliberately scoped to `sanitizeDOMTree`
+ * instead.
+ */
+const domStringAllowedAttributes = ['class', 'id', 'href', 'src', 'name', 'slot'];
+/**
+ * Attribute allowlist for `sanitizeDOMTree` (the select rich-content path).
+ * Covers global HTML attributes, the Ionic component presentational props
+ * that cloned rich content (e.g. `ion-select-option` markup) relies on, and
+ * the inert SVG presentation attributes used by inline icons.
  *
  * `aria-*` and `data-*` are allowed separately by prefix (refer
- * `allowedAttributePrefixes`) since they are inert and not worth
+ * `richContentAllowedAttributePrefixes`) since they are inert and not worth
  * enumerating. URL-bearing names (`href`, `src`) are allowed here, but
  * their values are still scrubbed for script schemes in `sanitizeElement`.
  *
@@ -280,7 +295,7 @@ export const reflectPropertiesToAttributes = (root) => {
  * form/navigation-hijack attributes (`formaction`, `action`, `target`),
  * which are therefore stripped.
  */
-const allowedAttributes = [
+const richContentAllowedAttributes = [
     // Global / structural
     'class',
     'id',
@@ -344,16 +359,16 @@ const allowedAttributes = [
     'opacity',
 ];
 /**
- * Attribute-name prefixes that are always safe to keep. `aria-*` and
- * `data-*` attributes cannot execute script or load resources, so they are
- * allowed wholesale rather than enumerated by name.
+ * Attribute-name prefixes that are always safe to keep in the rich-content
+ * path. `aria-*` and `data-*` attributes cannot execute script or load
+ * resources, so they are allowed wholesale rather than enumerated by name.
  */
-const allowedAttributePrefixes = ['aria-', 'data-'];
+const richContentAllowedAttributePrefixes = ['aria-', 'data-'];
 /**
  * Whether an attribute name (already lowercased) is safe to keep, by exact
  * match or by an allowed prefix.
  */
-const isAttributeAllowed = (lowerName) => {
+const isAttributeAllowed = (lowerName, allowedAttributes, allowedAttributePrefixes) => {
     if (allowedAttributes.includes(lowerName)) {
         return true;
     }

package/dist/collection/utils/select-option-render.js

@@ -72,6 +72,14 @@ export const cloneToVNode = (node, keyPrefix, index) => {
 const renderClonedContent = (id, content, className, useSpan = false) => {
     const Tag = useSpan ? 'span' : 'div';
     const keyPrefix = `${className}-${id}`;
+    /**
+     * Do not remove. This is the only sanitization pass for callers that pass
+     * an `HTMLElement` straight to `renderOptionLabel` (e.g. vanilla JS)
+     * without going through `getOptionContent`, which sanitizes upstream.
+     * `cloneToVNode` does pure structural conversion and no security
+     * filtering, so dropping this call would reopen an XSS hole on the
+     * direct `HTMLElement` path.
+     */
     sanitizeDOMTree(content);
     return (h(Tag, { class: className, key: keyPrefix }, Array.from(content.childNodes).map((child, i) => cloneToVNode(child, keyPrefix, i))));
 };

package/dist/docs.json

@@ -1,5 +1,5 @@
 {
-  "timestamp": "2026-06-24T23:09:21",
+  "timestamp": "2026-07-01T18:53:53",
   "compiler": {
     "name": "@stencil/core",
     "version": "4.43.5",
@@ -31885,7 +31885,7 @@
           "mutable": false,
           "attr": "disabled",
           "reflectToAttr": false,
-          "docs": "If `true`, the user cannot interact with the select option. This property does not apply when `interface=\"action-sheet\"` as `ion-action-sheet` does not allow for disabled buttons.",
+          "docs": "If `true`, the user cannot interact with the select option.",
           "docsTags": [
             {
               "name": "default",