dompurify 3.0.3 → 3.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +201 -11
- package/README.md +2 -2
- package/dist/purify.cjs.js +5 -5
- package/dist/purify.cjs.js.map +1 -1
- package/dist/purify.es.js +5 -5
- package/dist/purify.es.js.map +1 -1
- package/dist/purify.js +5 -5
- package/dist/purify.js.map +1 -1
- package/dist/purify.min.js +2 -2
- package/dist/purify.min.js.map +1 -1
- package/package.json +1 -1
package/dist/purify.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/*! @license DOMPurify 3.0.
|
|
1
|
+
/*! @license DOMPurify 3.0.5 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.0.5/LICENSE */
|
|
2
2
|
|
|
3
3
|
(function (global, factory) {
|
|
4
4
|
typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
|
|
@@ -259,7 +259,7 @@
|
|
|
259
259
|
*/
|
|
260
260
|
|
|
261
261
|
|
|
262
|
-
DOMPurify.version = '3.0.
|
|
262
|
+
DOMPurify.version = '3.0.5';
|
|
263
263
|
/**
|
|
264
264
|
* Array of elements that DOMPurify removed during sanitation.
|
|
265
265
|
* Empty if nothing was removed.
|
|
@@ -1068,10 +1068,10 @@
|
|
|
1068
1068
|
|
|
1069
1069
|
return true;
|
|
1070
1070
|
}
|
|
1071
|
-
/* Make sure that older browsers don't get
|
|
1071
|
+
/* Make sure that older browsers don't get fallback-tag mXSS */
|
|
1072
1072
|
|
|
1073
1073
|
|
|
1074
|
-
if ((tagName === 'noscript' || tagName === 'noembed') && regExpTest(/<\/no(script|embed)/i, currentNode.innerHTML)) {
|
|
1074
|
+
if ((tagName === 'noscript' || tagName === 'noembed' || tagName === 'noframes') && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
|
|
1075
1075
|
_forceRemove(currentNode);
|
|
1076
1076
|
|
|
1077
1077
|
return true;
|
|
@@ -1489,7 +1489,7 @@
|
|
|
1489
1489
|
returnNode = body;
|
|
1490
1490
|
}
|
|
1491
1491
|
|
|
1492
|
-
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.
|
|
1492
|
+
if (ALLOWED_ATTR.shadowroot || ALLOWED_ATTR.shadowrootmode) {
|
|
1493
1493
|
/*
|
|
1494
1494
|
AdoptNode() is not used because internal state is not reset
|
|
1495
1495
|
(e.g. the past names map of a HTMLFormElement), this is safe
|