dompurify 3.0.3 → 3.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -11
- package/README.md +2 -2
- package/dist/purify.cjs.js +5 -5
- package/dist/purify.cjs.js.map +1 -1
- package/dist/purify.es.js +5 -5
- package/dist/purify.es.js.map +1 -1
- package/dist/purify.js +5 -5
- package/dist/purify.js.map +1 -1
- package/dist/purify.min.js +2 -2
- package/dist/purify.min.js.map +1 -1
- package/package.json +1 -1
package/dist/purify.es.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 3.0.
|
|
1
|
+
/*! @license DOMPurify 3.0.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.5/LICENSE */
|
|
2
2
|
|
|
3
3
|
const {
|
|
4
4
|
entries,
|
|
@@ -253,7 +253,7 @@ function createDOMPurify() {
|
|
|
253
253
|
*/
|
|
254
254
|
|
|
255
255
|
|
|
256
|
-
DOMPurify.version = '3.0.
|
|
256
|
+
DOMPurify.version = '3.0.5';
|
|
257
257
|
/**
|
|
258
258
|
* Array of elements that DOMPurify removed during sanitation.
|
|
259
259
|
* Empty if nothing was removed.
|
|
@@ -1062,10 +1062,10 @@ function createDOMPurify() {
|
|
|
1062
1062
|
|
|
1063
1063
|
return true;
|
|
1064
1064
|
}
|
|
1065
|
-
/* Make sure that older browsers don't get
|
|
1065
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
1066
1066
|
|
|
1067
1067
|
|
|
1068
|
-
if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
|
|
1068
|
+
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
1069
1069
|
_forceRemove(currentNode);
|
|
1070
1070
|
|
|
1071
1071
|
return true;
|
|
@@ -1483,7 +1483,7 @@ function createDOMPurify() {
|
|
|
1483
1483
|
returnNode = body;
|
|
1484
1484
|
}
|
|
1485
1485
|
|
|
1486
|
-
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.
|
|
1486
|
+
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
1487
1487
|
/*
|
|
1488
1488
|
AdoptNode() is not used because internal state is not reset
|
|
1489
1489
|
(e.g. the past names map of a HTMLFormElement), this is safe
|