dompurify 3.4.15 → 3.4.17

package/src/purify.ts

@@ -14,6 +14,7 @@ import {
   arrayLastIndexOf,
   arrayPop,
   arrayPush,
+  arraySlice,
   arraySplice,
   stringMatch,
   stringReplace,
@@ -22,8 +23,12 @@ import {
   stringIndexOf,
   stringTrim,
   regExpTest,
+  setAdd,
+  setCreate,
+  setHas,
   isRegex,
   typeErrorCreate,
+  lookupAccessor,
   lookupGetter,
   create,
   objectHasOwnProperty,
@@ -75,10 +80,11 @@ const NODE_TYPE = {
          `<style>...</style><img onerror=x>` built as a node, which the literal
          serializer emits verbatim for the HTML parser to re-open.
    Shape (a) is handled by the firstElementChild branch in _isUnsafeNode; shape
-   (b) by the LITERAL_TEXT_CLOSE probe. Both read textContent (the raw-serialized
-   form for these elements) rather than innerHTML, because an XML/XHTML working
-   document serializes innerHTML with `<` escaped, which silently blinds the
-   innerHTML-based probes (rule 1's second probe and FALLBACK_TAG_CLOSE) there.
+   (b), and any other markup in the text, by the ELEMENT_MARKUP_PROBE branch next
+   to it. Both read textContent (the raw-serialized form for these elements)
+   rather than innerHTML, because an XML/XHTML working document serializes
+   innerHTML with `<` escaped, which silently blinds the innerHTML-based probes
+   (rule 1's second probe and FALLBACK_TAG_CLOSE) there.
    `script` is never allow-listed, but is kept here so the guard matches the
    serializer's own literal-text list exactly. */
 const LITERAL_TEXT_ELEMENT_NAMES = [
@@ -93,20 +99,6 @@ const LITERAL_TEXT_ELEMENT_NAMES = [
 ];
 const LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES));
 
-/* Per-element end-tag matcher. On an HTML reparse the ONLY token that
-   terminates a literal-text element's raw content is its own end tag; a foreign
-   literal-text close (e.g. `</xmp>` sitting inside `<style>`) does not break
-   out, so matching is per-element, not a shared alternation. The lookahead
-   requires an HTML tag-name terminator (whitespace, `/` or `>`) so a longer
-   name such as `</styles` is not mistaken for `</style`. */
-const LITERAL_TEXT_CLOSE = (function (): Record<string, RegExp> {
-  const map: Record<string, RegExp> = {};
-  arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => {
-    map[name] = seal(new RegExp('</' + name + '(?=[\\t\\n\\f\\r />])', 'i'));
-  });
-  return freeze(map);
-})();
-
 const getGlobal = function (): WindowLike {
   return typeof window === 'undefined' ? null : window;
 };
@@ -303,6 +295,17 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     return getNodeName ? getNodeName(node) : (node as any).nodeName;
   };
 
+  /* Element namespace through the cached Element.prototype getter, so a live
+     node's own-property override (Object.defineProperty) cannot steer
+     namespace decisions; direct read where the getter does not exist. Only
+     call this on Elements - the getter throws on other node types. */
+  const getNamespaceURI = lookupAccessor(ElementPrototype, 'namespaceURI');
+  const _readNamespaceURI = function (element: Element): string | null {
+    return getNamespaceURI
+      ? getNamespaceURI(element)
+      : (element as any).namespaceURI;
+  };
+
   // As per issue #47, the web-components registry is inherited by a
   // new document created via createHTMLDocument. As per the spec
   // (http://w3c.github.io/webcomponents/spec/custom/#creating-and-passing-registries)
@@ -576,6 +579,9 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    * of importing it into a new Document and returning a sanitized copy */
   let IN_PLACE = false;
 
+  /* IN_PLACE: nodes processed during the current call */
+  let IN_PLACE_VISITED: Set<unknown> | null = null;
+
   /* Allow usage of profiles like html, svg and mathMl */
   let USE_PROFILES: UseProfilesConfig | false = {};
 
@@ -1152,40 +1158,50 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    *  return. Return true otherwise.
    */
   const _checkValidNamespace = function (element: Element): boolean {
-    let parent = getParentNode(element);
-
-    // In JSDOM, if we're inside shadow DOM, then parentNode
-    // can be null. We just simulate parent in this case.
-    if (!parent || !parent.tagName) {
-      parent = {
-        namespaceURI: NAMESPACE,
-        tagName: 'template',
-      };
+    /* Read names and namespaces through the cached prototype getters, never
+       the instance properties. A live IN_PLACE node can carry own-property
+       overrides of tagName / namespaceURI (Object.defineProperty) that would
+       otherwise steer the classification below: a namespace-confused node
+       posing as a plain HTML element, or a parent posing as an integration
+       point. Same root cause as GHSA-x4vx-rjvf-j5p4 (nodeName); for elements
+       nodeName is the tagName. */
+    const elementNamespace = _readNamespaceURI(element);
+    const tagName = stringToLowerCase(_readNodeName(element));
+
+    // A missing parent (JSDOM inside shadow DOM) or a non-element parent
+    // (DocumentFragment, ShadowRoot, Document) is simulated as a <template>
+    // in the configured namespace, as before.
+    const parentNode = getParentNode(element);
+    let parent: { namespaceURI: string | null };
+    let parentTagName: string;
+    if (parentNode && _readNodeType(parentNode) === NODE_TYPE.element) {
+      parent = { namespaceURI: _readNamespaceURI(parentNode) };
+      parentTagName = stringToLowerCase(_readNodeName(parentNode));
+    } else {
+      parent = { namespaceURI: NAMESPACE };
+      parentTagName = 'template';
     }
 
-    const tagName = stringToLowerCase(element.tagName);
-    const parentTagName = stringToLowerCase(parent.tagName);
-
-    if (!ALLOWED_NAMESPACES[element.namespaceURI]) {
+    if (!ALLOWED_NAMESPACES[elementNamespace]) {
       return false;
     }
 
-    if (element.namespaceURI === SVG_NAMESPACE) {
+    if (elementNamespace === SVG_NAMESPACE) {
       return _checkSvgNamespace(tagName, parent, parentTagName);
     }
 
-    if (element.namespaceURI === MATHML_NAMESPACE) {
+    if (elementNamespace === MATHML_NAMESPACE) {
       return _checkMathMlNamespace(tagName, parent, parentTagName);
     }
 
-    if (element.namespaceURI === HTML_NAMESPACE) {
+    if (elementNamespace === HTML_NAMESPACE) {
       return _checkHtmlNamespace(tagName, parent, parentTagName);
     }
 
     // For XHTML and XML documents that support custom namespaces
     if (
       PARSER_MEDIA_TYPE === 'application/xhtml+xml' &&
-      ALLOWED_NAMESPACES[element.namespaceURI]
+      ALLOWED_NAMESPACES[elementNamespace]
     ) {
       return true;
     }
@@ -1271,46 +1287,29 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * _neutralizeRoot
-   *
-   * Fail-closed teardown of an in-place root after the sanitize walk aborts
-   * (campaign-3 F2). An internal throw mid-walk — e.g. a page-registered
-   * custom element's reaction detaches a node so `_forceRemove`'s deliberate
-   * parentless guard throws, or any other re-entrant engine mutation — would
-   * otherwise leave the caller's *live* tree half-sanitized, with everything
-   * after the abort point still carrying its handlers. There is no safe way
-   * to resume the walk (the tree mutated under us), so we strip the root bare:
-   * remove every child and every attribute, then let the caller's catch see
-   * the original error. Clobber-safe (cached `remove`/`childNodes`/`attributes`
-   * getters; the root was already clobber-pre-flighted at the IN_PLACE entry).
+   * Fail-closed teardown of an in-place root: strip every disallowed attribute
+   * in the subtree first, so nothing armed is left behind, then remove all
+   * children and the root's own attributes.
    *
    * @param root the in-place root to empty
    */
   const _neutralizeRoot = function (root: Node): void {
-    /* Strip every disallowed attribute (on* handlers included) off the whole
-       subtree BEFORE detaching anything. Detaching first would hand back
-       handler-bearing originals (e.g. an already-loading `<img onerror>`)
-       whose queued resource event still fires in page scope after we throw.
-       Clobber-safe reads; a doomed clobbered node's own attributes are
-       irrelevant while its non-clobbered descendants are reached and scrubbed. */
     _neutralizeSubtree(root);
 
     const childNodes = getChildNodes(root);
     if (childNodes) {
-      const snapshot: Node[] = [];
-      arrayForEach(childNodes, (child) => {
-        arrayPush(snapshot, child);
-      });
-      arrayForEach(snapshot, (child) => {
+      arrayForEach(arraySlice(childNodes), (child: Node) => {
         try {
           remove(child);
         } catch (_) {
-          /* Best-effort teardown; a still-attached child is handled below */
+          /* Best effort */
         }
       });
     }
 
-    const attributes = getAttributes(root);
+    // Only elements have attributes; the root may be a rejected fragment
+    const attributes =
+      _readNodeType(root) === NODE_TYPE.element ? getAttributes(root) : null;
     if (attributes) {
       for (let i = attributes.length - 1; i >= 0; --i) {
         const attribute = attributes[i];
@@ -1323,18 +1322,9 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * _removeAttribute
-   *
-   * Name-based getAttributeNode()/removeAttribute() ASCII-lowercase their
-   * lookup key for HTML elements in an HTML document, so they silently miss an
-   * attribute whose stored qualified name still contains uppercase ASCII
-   * letters. That happens when the node came from a case-preserving source
-   * (an XML/XHTML document imported via importNode(), or createAttributeNS()),
-   * where e.g. `ONERROR` survives the walk: the policy check lowercases to
-   * `onerror` and rejects it, but `removeAttribute('ONERROR')` looks up
-   * `onerror` and finds nothing. Remove the exact Attr node instead, which is
-   * case- and namespace-exact, and fall back to name-based removal only when
-   * the caller could not supply the node.
+   * Removes an attribute, preferably as its exact Attr node: name-based
+   * removal lowercases the name in HTML documents and misses case-preserved
+   * names, e.g. from imported XHTML.
    *
    * @param name an Attribute name
    * @param element a DOM node
@@ -1365,13 +1355,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         element.removeAttribute(name);
       }
     } catch (_) {
-      /* Clobbered or already-detached node - best-effort fall back to a
-         name-based removal so the "is" handling below still runs. Note this
-         fallback ASCII-lowercases its lookup key in an HTML document and so
-         cannot reach a case-preserved attribute name; the cached
-         removeAttributeNode() above is what removes those, and a clobbered
-         form is already removed wholesale by _isClobbered() before reaching
-         here. */
+      /* Clobbered or detached node: fall back to name-based removal */
       try {
         element.removeAttribute(name);
       } catch (_) {}
@@ -1392,12 +1376,8 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * _stripDisallowedAttributes
-   *
-   * Removes every attribute the active configuration does not allow from a
-   * single element, using the same allowlist as the main attribute pass (so
-   * `on*` handlers go, but no `/^on/` blocklist is introduced). Used only to
-   * neutralise nodes that are being discarded from an in-place tree.
+   * Removes every attribute the configuration does not allow. Used to
+   * neutralize nodes discarded from an in-place tree.
    *
    * @param element the element to strip
    */
@@ -1419,36 +1399,33 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * _neutralizeSubtree
+   * Iterative depth-first walk, so deep trees cannot overflow the call stack,
+   * reading through the cached getters, so clobbering cannot hide children.
+   * When `visit` returns false, the node's children are skipped. With
+   * `intoShadow`, open shadow roots are walked after their host's children.
    *
-   * Completes the audit-5 F1 fix across every removal path. The KEEP_CONTENT
-   * move-hoist neutralises only disallowed-tag removals; clobber, mXSS-canary,
-   * namespace, comment, processing-instruction and KEEP_CONTENT:false removals
-   * all drop their subtree wholesale via `_forceRemove`. On the IN_PLACE path
-   * those dropped nodes are detached from the caller's LIVE tree but a
-   * handler-bearing original among them (an `<img onerror>`/`<video>` that was
-   * loading) keeps its queued resource event, which fires in page scope after
-   * sanitize returns. This walks a removed subtree and strips every attribute
-   * the active configuration does not allow — so `on*` handlers are cancelled
-   * through the SAME allowlist that governs kept nodes, not a separate `/^on/`
-   * blocklist. Run synchronously before sanitize returns, i.e. before any
-   * queued event can fire. Hook-free by design: these nodes leave the output,
-   * so firing attribute hooks for them would be surprising. Clobber-safe reads;
-   * a doomed clobbered node may shadow `removeAttribute` (its own attributes are
-   * irrelevant — it is discarded — while its non-clobbered descendants, e.g.
-   * the `<img>`, are reached and scrubbed).
-   *
-   * @param root the root of a removed subtree to neutralise
+   * @param root where to start
+   * @param visit called for every node
+   * @param intoShadow whether to enter open shadow roots
    */
-  const _neutralizeSubtree = function (root: Node): void {
+  const _walkTree = function (
+    root: Node,
+    visit: (node: Node) => boolean | void,
+    intoShadow = false
+  ): void {
     const stack: Node[] = [root];
 
     while (stack.length > 0) {
       const node = stack.pop();
-      const nodeType = _readNodeType(node);
+      if (visit(node) === false) {
+        continue;
+      }
 
-      if (nodeType === NODE_TYPE.element) {
-        _stripDisallowedAttributes(node as Element);
+      if (intoShadow && _readNodeType(node) === NODE_TYPE.element) {
+        const shadowRoot = getShadowRoot(node);
+        if (_isDocumentFragment(shadowRoot)) {
+          stack.push(shadowRoot);
+        }
       }
 
       const childNodes = getChildNodes(node);
@@ -1461,46 +1438,191 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * _neutralizePatchLinkage
+   * Strips disallowed attributes from every element of a discarded subtree,
+   * so a handler that is already queued (a loading image) cannot fire.
    *
-   * IN_PLACE entry pre-pass (declarative-partial-updates / streaming
-   * hardening, https://github.com/WICG/declarative-partial-updates).
+   * @param root the root of a removed subtree
+   */
+  const _neutralizeSubtree = function (root: Node): void {
+    _walkTree(root, (node) => {
+      if (_readNodeType(node) === NODE_TYPE.element) {
+        _stripDisallowedAttributes(node as Element);
+      }
+    });
+  };
+
+  /**
+   * All nodes under `root`, root first, including open shadow roots. Template
+   * content is not entered, it is inert.
    *
-   * The main walk strips patch linkage (`for`/`patchsrc`) and removes range
-   * markers (PIs / markup comments) node-by-node, in document order, AS it
-   * reaches each node. On a live in-place root that leaves a window: from the
-   * moment the root is connected until the walk arrives at a given node, that
-   * node's linkage is live. A patch applied on connection/stream can fire as
-   * a microtask during the walk and inject or teleport an unsanitized DOM
-   * range into a region the iterator has already passed and will not revisit,
-   * so the post-return "tree is sanitized" contract is violated. Sweep the
-   * whole tree once up front and sever every linkage before the walk begins,
-   * closing that window.
+   * @param root the in-place root
+   * @return the nodes
+   */
+  const _collectLiveNodes = function (root: Node): Node[] {
+    const nodes: Node[] = [];
+    _walkTree(
+      root,
+      (node) => {
+        nodes.push(node);
+      },
+      true
+    );
+    return nodes;
+  };
+
+  /**
+   * Strips disallowed attributes from every element that was under the
+   * in-place root when the call started and no longer is, whatever removed
+   * or moved it.
    *
-   * This CANNOT undo a patch that already fired before sanitize ran — that is
-   * the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
-   * but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
-   * to group with the rest of the declarative-partial-updates handling and
-   * stay overridable, consistent with the codebase.
+   * @param root the in-place root
+   * @param before the root's nodes, collected before the walk
+   */
+  const _neutralizeEscapedElements = function (
+    root: Node,
+    before: Node[]
+  ): void {
+    const reachable = setCreate();
+    arrayForEach(_collectLiveNodes(root), (node: Node) => {
+      if (_readNodeType(node) === NODE_TYPE.element) {
+        setAdd(reachable, node);
+      }
+    });
+    arrayForEach(before, (node: Node) => {
+      if (
+        _readNodeType(node) === NODE_TYPE.element &&
+        !setHas(reachable, node)
+      ) {
+        _stripDisallowedAttributes(node as Element);
+      }
+    });
+  };
+
+  /**
+   * Neutralizes everything that left the in-place tree during the call: what
+   * DOMPurify removed, and what hooks or custom elements removed or moved out.
+   *
+   * @param root the in-place root
+   * @param before the root's nodes, collected before the walk
+   * @return true if the root itself was removed
+   */
+  const _neutralizeDiscarded = function (root: Node, before: Node[]): boolean {
+    let rootRemoved = false;
+    arrayForEach(DOMPurify.removed, (entry) => {
+      if (entry.element) {
+        rootRemoved = rootRemoved || entry.element === root;
+        _neutralizeSubtree(entry.element as Node);
+      }
+    });
+    _neutralizeEscapedElements(root, before);
+    return rootRemoved;
+  };
+
+  const MAX_UNVISITED_ROUNDS = 8;
+
+  /**
+   * The walk only moves forward, so a node moved to a position it already
+   * passed is never visited. Give every original node that is still in the
+   * tree but unvisited the normal treatment, hooks included. Nodes created
+   * during the call are left alone. Fails closed if the tree keeps changing.
    *
-   * Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
-   * clobbered root cannot defeat the sweep of its non-clobbered descendants.
+   * @param root the in-place root
+   * @param before the root's nodes, collected before the walk
+   */
+  const _sanitizeUnvisitedNodes = function (root: Node, before: Node[]): void {
+    const visited = IN_PLACE_VISITED;
+    /* Built lazily: usually every live node was visited */
+    let original: Set<unknown> | null = null;
+    const getOriginal = (): Set<unknown> => {
+      if (!original) {
+        original = setCreate();
+        arrayForEach(before, (beforeNode: Node) => {
+          setAdd(original, beforeNode);
+        });
+      }
+
+      return original;
+    };
+
+    for (let round = 0; ; round++) {
+      const live = _collectLiveNodes(root);
+      const containers: Node[] = [root];
+      let pending = false;
+
+      arrayForEach(live, (node: Node) => {
+        if (_readNodeType(node) === NODE_TYPE.documentFragment) {
+          /* An open shadow root under the root */
+          arrayPush(containers, node);
+        } else if (!pending && !setHas(visited, node)) {
+          pending = setHas(getOriginal(), node);
+        }
+      });
+
+      if (!pending) {
+        return;
+      }
+
+      if (round >= MAX_UNVISITED_ROUNDS) {
+        throw typeErrorCreate(
+          'the tree kept changing during in-place sanitization; ' +
+            'refusing to return it'
+        );
+      }
+
+      arrayForEach(containers, (container: Node, index: number) => {
+        _sanitizeUnvisitedIn(container, index > 0, root, getOriginal());
+      });
+    }
+  };
+
+  /**
+   * One _sanitizeUnvisitedNodes pass over the root or an open shadow root.
    *
-   * NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
-   * .html Q1): this mirrors the existing policy of keeping `for` on
-   * <label>/<output>. If the shipping feature can drive a patch through a
-   * surviving `for`-on-label/output + `id` pair, this pre-pass and the
-   * attribute check at _isBasicCustomElement's caller must additionally drop
-   * that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
+   * @param container the root or an open shadow root
+   * @param inShadow whether container is a shadow root
+   * @param root the in-place root
+   * @param original the root's nodes collected before the walk, as a set
+   */
+  const _sanitizeUnvisitedIn = function (
+    container: Node,
+    inShadow: boolean,
+    root: Node,
+    original: Set<unknown>
+  ): void {
+    const iterator = _createNodeIterator(container);
+    let node: Node | null;
+    while ((node = iterator.nextNode())) {
+      if (!setHas(original, node) || setHas(IN_PLACE_VISITED, node)) {
+        continue;
+      }
+
+      if (inShadow) {
+        _executeHooks(hooks.uponSanitizeShadowNode, node, null);
+      }
+
+      _sanitizeElements(node, root);
+      _sanitizeAttributes(node as Element, root);
+      if (_isDocumentFragment((node as HTMLTemplateElement).content)) {
+        _sanitizeShadowDOM((node as HTMLTemplateElement).content);
+      }
+    }
+  };
+
+  /**
+   * Records that _sanitizeElements processed `node`. No-op outside IN_PLACE.
    *
-   * @param root the in-place root to sweep
+   * @param node the node being processed
    */
+  const _markVisited = function (node: Node): void {
+    if (IN_PLACE_VISITED) {
+      setAdd(IN_PLACE_VISITED, node);
+    }
+  };
+
   /**
-   * Central policy for declarative-partial-updates patch-linkage attributes,
-   * shared by the _neutralizePatchLinkage pre-pass and _isValidAttribute so
-   * the two sites cannot drift: `patchsrc` always links, `for` links
-   * everywhere except on <label>/<output>, and the whole policy is gated on
-   * SAFE_FOR_XML (see the rationale block in _isValidAttribute).
+   * Patch-linkage attributes (declarative partial updates): `patchsrc`
+   * always, `for` everywhere except on <label> and <output>. Gated on
+   * SAFE_FOR_XML. Shared by the IN_PLACE pre-pass and _isValidAttribute.
    *
    * @param lcName the transformCaseFunc'd attribute name
    * @param lcTag the transformCaseFunc'd tag name of the carrying element
@@ -1521,18 +1643,26 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     return lcName === 'for' && lcTag !== 'label' && lcTag !== 'output';
   };
 
+  /**
+   * IN_PLACE pre-pass: sever all patch linkage before the walk, so no patch
+   * can fire mid-walk into a part of the tree the walker already passed.
+   * Removes range markers (processing instructions, comments with markup)
+   * and strips linkage attributes. It cannot undo a patch that already fired.
+   *
+   * TODO: if the shipped feature can patch through `for` on <label>/<output>,
+   * drop that pair here too (see test/declarative-patch-probe.html).
+   *
+   * @param root the in-place root to sweep
+   */
   const _neutralizePatchLinkage = function (root: Node): void {
     if (!SAFE_FOR_XML) {
       return;
     }
 
-    const stack: Node[] = [root];
-    while (stack.length > 0) {
-      const node = stack.pop();
+    _walkTree(root, (node) => {
       const nodeType = _readNodeType(node);
 
-      /* Remove range markers (the target side of a patch linkage): every
-         processing instruction, and any markup-bearing comment. */
+      // Range markers: processing instructions, comments with markup
       if (
         nodeType === NODE_TYPE.processingInstruction ||
         (nodeType === NODE_TYPE.comment &&
@@ -1541,13 +1671,13 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         try {
           remove(node);
         } catch (_) {
-          /* Best-effort */
+          /* Best effort */
         }
 
-        continue;
+        return false;
       }
 
-      /* Strip patch-source attributes (the source side) off elements. */
+      // Linkage attributes
       if (nodeType === NODE_TYPE.element) {
         const element = node as Element;
         const lcTag = transformCaseFunc(_readNodeName(node));
@@ -1564,17 +1694,12 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
             element.removeAttribute('for');
           }
         } catch (_) {
-          /* Clobbered removeAttribute/hasAttribute on a doomed node — ignore */
+          /* Clobbered methods on a doomed node */
         }
       }
 
-      const childNodes = getChildNodes(node);
-      if (childNodes) {
-        for (let i = childNodes.length - 1; i >= 0; --i) {
-          stack.push(childNodes[i]);
-        }
-      }
-    }
+      return true;
+    });
   };
 
   /**
@@ -1715,6 +1840,36 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    * @param node The root element whose character data should be scrubbed.
    */
   const _scrubTemplateExpressions = function (node: Element): void {
+    _scrubOwnCharacterData(node);
+
+    // NodeIterator does not descend into <template>.content per the DOM spec,
+    // so we must explicitly recurse into each template's content fragment,
+    // mirroring the approach used by _sanitizeShadowDOM.
+    const templates = node.querySelectorAll?.('template');
+    if (templates) {
+      arrayForEach(templates, (tmpl: HTMLTemplateElement) => {
+        if (_isDocumentFragment(tmpl.content)) {
+          _scrubTemplateExpressions(tmpl.content as unknown as Element);
+        }
+      });
+    }
+  };
+
+  /**
+   * _scrubOwnCharacterData
+   *
+   * Non-recursive core of _scrubTemplateExpressions: normalize `node` and
+   * strip template expressions from its own character data only. Does not
+   * enter <template>.content or attached shadow roots (NodeIterator never
+   * does). Used by _sanitizeShadowDOM, where every nested template content
+   * and shadow root is already walked - and therefore scrubbed - by its own
+   * recursive _sanitizeShadowDOM call; recursing here as well would rescrub
+   * each nested fragment once per ancestor, which is quadratic in nesting
+   * depth.
+   *
+   * @param node The root whose own character data should be scrubbed.
+   */
+  const _scrubOwnCharacterData = function (node: Element): void {
     node.normalize();
     /* Clobber-safe ownerDocument read, same reasoning as _createNodeIterator:
        under SAFE_FOR_TEMPLATES this runs on the live IN_PLACE root, which may
@@ -1736,18 +1891,6 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       currentNode.data = _stripTemplateExpressions(currentNode.data);
       currentNode = walker.nextNode() as CharacterData | null;
     }
-
-    // NodeIterator does not descend into <template>.content per the DOM spec,
-    // so we must explicitly recurse into each template's content fragment,
-    // mirroring the approach used by _sanitizeShadowDOM.
-    const templates = node.querySelectorAll?.('template');
-    if (templates) {
-      arrayForEach(templates, (tmpl: HTMLTemplateElement) => {
-        if (_isDocumentFragment(tmpl.content)) {
-          _scrubTemplateExpressions(tmpl.content as unknown as Element);
-        }
-      });
-    }
   };
 
   /**
@@ -1914,14 +2057,31 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
        is why both probes here read textContent instead. Previously only
        `style`-with-element-child was covered; every element in
        LITERAL_TEXT_ELEMENTS shares this literal serialization and is
-       equally affected. */
+       equally affected.
+
+       The text probe is rule 1's ELEMENT_MARKUP_PROBE, not just the element's
+       own end tag. For these elements textContent is exactly what an HTML
+       serializer emits, so in an HTML working document this is the same
+       decision rule 1 already makes there (markup-like text is removed). Only
+       matching the own end tag let an XML/XHTML-sourced literal-text element
+       keep markup such as `</style><img onerror>` that the same input loses in
+       HTML mode, and that breaks out once the output is placed in another
+       raw-text context.
+
+       Namespace through the cached getter (see _checkValidNamespace), and only
+       for Elements: a processing instruction's nodeName is its target, which
+       can collide with a name in LITERAL_TEXT_ELEMENTS. */
     if (
       SAFE_FOR_XML &&
-      currentNode.namespaceURI === HTML_NAMESPACE &&
       LITERAL_TEXT_ELEMENTS[tagName] &&
+      _readNodeType(currentNode) === NODE_TYPE.element &&
+      _readNamespaceURI(currentNode) === HTML_NAMESPACE &&
       (_isNode(currentNode.firstElementChild) ||
         (typeof currentNode.textContent === 'string' &&
-          regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent)))
+          regExpTest(
+            EXPRESSIONS.ELEMENT_MARKUP_PROBE,
+            currentNode.textContent
+          )))
     ) {
       return true;
     }
@@ -2010,7 +2170,16 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
          path was dead in safe cases and a clobbering surface in unsafe
          ones. Falsy cached results stay falsy; the `if (childNodes &&
          parentNode)` check already gates correctly. */
-    if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+    if (
+      KEEP_CONTENT &&
+      !FORBID_CONTENTS[tagName] &&
+      /* The default list is lowercase, but in application/xhtml+xml mode
+         tagName keeps its case, so `foreignObject` would miss its
+         `foreignobject` entry and have its content hoisted instead of
+         dropped, unlike in HTML mode. Also consult the lowercased name; this
+         can only drop more content, never keep more. */
+      !FORBID_CONTENTS[stringToLowerCase(tagName)]
+    ) {
       const parentNode = getParentNode(currentNode);
       const childNodes = getChildNodes(currentNode);
 
@@ -2079,35 +2248,13 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   };
 
   /**
-   * Shared guard for a node that a hook has detached from the walk tree,
-   * used after each element-hook site in _sanitizeElements. Detaching is a
-   * long-standing user pattern (issue #469; draw.io-style foreignObject
-   * filtering). Per the cached, unclobberable parentNode getter the node is
-   * genuinely out of the tree, so it can reach neither the serialized
-   * output nor an IN_PLACE live tree; treat it as removed and stop
-   * processing it. Without this guard, the unsafe-node / namespace checks
-   * would call _forceRemove on a parentless node and hit the REPORT-3
-   * fail-closed throw — which exists for nodes DOMPurify wants gone but
-   * *cannot* detach (clobbered / parentless roots), the opposite of a node
-   * that is already safely gone. The walk root is exempt: a detached
-   * IN_PLACE root is legitimate input and must still be fully sanitized,
-   * and a kill-decision on it must keep hitting the REPORT-3 throw.
-   *
-   * Nodes detached by hooks stay the hook's responsibility for placement:
-   * they are not recorded in DOMPurify.removed, so the post-walk IN_PLACE
-   * pass (which iterates DOMPurify.removed) does not reach them. But a
-   * hook-detached subtree can still hold a queued resource-event handler -
-   * e.g. an <img onload> that began loading when the caller built the live
-   * tree - which fires in page scope after sanitize returns even though the
-   * handler never reached the returned tree. That is the audit-5 F1 hazard,
-   * and the documented node.remove() hook pattern walks straight into it.
-   * So on the IN_PLACE path we neutralize the detached subtree inline,
-   * stripping its non-allow-listed attributes before returning, exactly as
-   * the post-walk pass does for _forceRemove'd subtrees.
+   * A hook may have detached the node it was called for. If so, treat it as
+   * removed and stop processing it; the walk root is exempt. On the IN_PLACE
+   * path the detached subtree is neutralized right away.
    *
    * @param currentNode the node a hook may have detached
    * @param root the current walk root
-   * @return true if the node is detached and now handled, false otherwise
+   * @return true if the node was detached
    */
   const _handleHookDetachedNode = function (
     currentNode: Node,
@@ -2134,6 +2281,9 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    * @return true if node was killed, false if left alive
    */
   const _sanitizeElements = function (currentNode: any, root: Node): boolean {
+    /* IN_PLACE: remember the node was processed (see _sanitizeUnvisitedNodes). */
+    _markVisited(currentNode);
+
     /* Execute a hook if present */
     _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
 
@@ -2206,6 +2356,14 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
          skipped; they are removal decisions, not the hook contract. */
       if (removed === false) {
         _executeHooks(hooks.afterSanitizeElements, currentNode, null);
+
+        /* The hook may have detached the kept custom element. Same
+           IN_PLACE hazard as the before/upon sites: neutralize the
+           detached subtree before the walker skips past it (see
+           _handleHookDetachedNode). */
+        if (_handleHookDetachedNode(currentNode, root)) {
+          return true;
+        }
       }
 
       return removed;
@@ -2248,7 +2406,14 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     /* Execute a hook if present */
     _executeHooks(hooks.afterSanitizeElements, currentNode, null);
 
-    return false;
+    /* The afterSanitizeElements hook is the documented place for
+       node.remove() policies, and a detach here is invisible to every later
+       pass: the iterator advances past the detached subtree, so its
+       descendants are never visited, and hook-detached nodes are not in
+       DOMPurify.removed, so the post-walk IN_PLACE pass does not reach them
+       either. Apply the same detach-neutralization invariant as the
+       before/upon sites: true (removed) if the hook detached the node. */
+    return _handleHookDetachedNode(currentNode, root);
   };
 
   /**
@@ -2508,6 +2673,47 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     }
   };
 
+  /**
+   * _isUnsafeAttributeValue
+   *
+   * Value-based attribute checks that the attribute walk applies before any
+   * hook can force-keep an attribute, shared with the public
+   * isValidAttribute() so that it never approves a value sanitize() would
+   * strip.
+   *
+   * @param name the attribute name as found on the node (case preserved)
+   * @param value the attribute value
+   * @returns true if the attribute must be removed because of its value
+   */
+  const _isUnsafeAttributeValue = function (
+    name: string,
+    value: string
+  ): boolean {
+    /* Work around a security issue with comments inside attributes, and
+       raw-text closers that re-contextualize the value on a later reparse */
+    if (
+      SAFE_FOR_XML &&
+      regExpTest(
+        /((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i,
+        value
+      )
+    ) {
+      return true;
+    }
+
+    /* Make sure we cannot easily use animated hrefs, even if animations are
+       allowed. Compared case-insensitively on purpose: in
+       application/xhtml+xml mode names keep their case, and the real SVG
+       attribute is spelled attributeName, which 'attributename' would
+       never match (GHSA-c6gr-qvv4-5v3f). In XHTML a lowercase
+       `attributename` is not the SMIL attribute, so also stripping it
+       there costs nothing. */
+    return (
+      stringToLowerCase(name) === 'attributename' &&
+      stringMatch(value, 'href') !== null
+    );
+  };
+
   /**
    * _sanitizeAttributes
    *
@@ -2517,12 +2723,23 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    * @protect setAttribute
    *
    * @param currentNode to sanitize
+   * @param root the current walk root
    */
-  // eslint-disable-next-line complexity
-  const _sanitizeAttributes = function (currentNode: Element): void {
+  const _sanitizeAttributes = function (
+    currentNode: Element,
+    root: Node
+  ): void {
     /* Execute a hook if present */
     _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
 
+    /* A hook may have detached the node - the attribute hooks can detach
+       exactly like the element hooks can, and the walker will not revisit
+       the detached subtree. Treat it as removed and, on the IN_PLACE path,
+       neutralize it (see _handleHookDetachedNode for the full rationale). */
+    if (_handleHookDetachedNode(currentNode, root)) {
+      return;
+    }
+
     const { attributes } = currentNode;
 
     /* Check if we have attributes; if not we might have a text node */
@@ -2595,20 +2812,9 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       // Else: already prefixed, leave the attribute alone — the prefix is
       // itself the clobbering protection, and re-applying it is incorrect.
 
-      /* Work around a security issue with comments inside attributes */
-      if (
-        SAFE_FOR_XML &&
-        regExpTest(
-          /((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i,
-          value
-        )
-      ) {
-        _removeAttribute(name, currentNode, attr);
-        continue;
-      }
-
-      /* Make sure we cannot easily use animated hrefs, even if animations are allowed */
-      if (lcName === 'attributename' && stringMatch(value, 'href')) {
+      /* Value checks that apply regardless of hooks (comment / raw-text
+         closers in the value, animated hrefs); see _isUnsafeAttributeValue. */
+      if (_isUnsafeAttributeValue(name, value)) {
         _removeAttribute(name, currentNode, attr);
         continue;
       }
@@ -2668,6 +2874,11 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
 
     /* Execute a hook if present */
     _executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
+
+    /* Same detach re-check as after beforeSanitizeAttributes: this is the
+       last hook that runs for the node, so a detach here would otherwise
+       hand the caller a live, handler-bearing subtree. */
+    _handleHookDetachedNode(currentNode, root);
   };
 
   /**
@@ -2690,7 +2901,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       _sanitizeElements(shadowNode, fragment);
 
       /* Check attributes next */
-      _sanitizeAttributes(shadowNode);
+      _sanitizeAttributes(shadowNode, fragment);
 
       /* Deep shadow DOM detected.
          Realm-safe check (GHSA-hpcv-96wg-7vj8): use nodeType against the
@@ -2719,53 +2930,50 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       }
     }
 
+    /* Post-walk template-expression safety net, mirroring the light-DOM
+       passes on `dirty` / `body`. The per-node strip above (via
+       _sanitizeElements) only sees each text node in isolation, so an
+       expression split across text siblings by a disallowed separator element
+       (e.g. `$` <object> `{alert(1)}`) survives: each fragment matches no
+       delimiter regex on its own, and once the separator is removed the
+       fragments become adjacent and serialize as one complete expression.
+       The light-DOM net catches exactly this, but NodeIterator does not
+       descend into shadow trees and node.normalize() does not merge text
+       across the shadow boundary, so the fragments were never re-examined as
+       a merged unit. normalize() here (inside _scrubTemplateExpressions)
+       merges them and re-strips. Deliberately the non-recursive variant: each
+       nested shadow root and template content is walked by its own
+       _sanitizeShadowDOM call above and scrubbed there, so every fragment is
+       scrubbed exactly once (the recursive variant would make this quadratic
+       in nesting depth). Gated on SAFE_FOR_TEMPLATES like the light-DOM
+       passes, and placed before the afterSanitizeShadowDOM hook so that hook
+       observes the finalized fragment. */
+    if (SAFE_FOR_TEMPLATES) {
+      _scrubOwnCharacterData(fragment as unknown as Element);
+    }
+
     /* Execute a hook if present */
     _executeHooks(hooks.afterSanitizeShadowDOM, fragment, null);
   };
 
   /**
-   * _sanitizeAttachedShadowRoots
-   *
-   * Walks `root` and feeds every attached shadow root we encounter into
-   * the existing _sanitizeShadowDOM pipeline. The default node iterator
-   * does not descend into shadow trees, so nodes inside an attached
-   * shadow root would otherwise be skipped entirely.
-   *
-   * Two real input paths put attached shadow roots in front of us:
-   *   1. IN_PLACE on a DOM node that already has shadow roots attached.
-   *   2. DOM-node input where importNode(dirty, true) deep-clones the
-   *      shadow root because it was created with `clonable: true`.
-   *
-   * This pass runs once, up front, so the main iteration loop (and the
-   * existing _sanitizeShadowDOM template-content recursion) stay
-   * untouched — string-input paths are not affected.
+   * Sanitizes every attached shadow root under `root`, since the node
+   * iterator does not enter shadow trees. Needed for IN_PLACE input and for
+   * DOM input whose clonable shadow roots were copied by importNode().
    *
    * @param root the subtree root to walk for attached shadow roots
    */
   const _sanitizeAttachedShadowRoots = function (root: Node): void {
-    /* Iterative (explicit stack) rather than per-child recursion. DOM APIs
-       impose no depth cap, so an attacker-shaped tree (JSON/CRDT/editor data
-       built straight into the DOM — the IN_PLACE surface) deeper than the JS
-       call-stack budget would otherwise overflow native recursion here and
-       throw at the IN_PLACE entry pre-pass, before a single node is
-       sanitized, leaving the caller's live tree untouched (fail-open). See
-       campaign-3 F4. A heap stack keeps depth off the call stack.
-
-       Each work item is either a node to descend into, or a deferred
-       `_sanitizeShadowDOM` for an already-walked shadow root. The deferred
-       form preserves the original post-order discipline: a shadow root's
-       nested shadow roots are discovered before the outer shadow is
-       sanitized (which may remove hosts). Pushes are in reverse of the
-       desired processing order (LIFO): template content, then children, then
-       the shadow-sanitize, then the shadow walk — so the order matches the
-       previous recursion exactly. */
+    /* Explicit stack, so deep trees cannot overflow the call stack. An item is
+       a node to walk or a shadow root to sanitize. Items are processed in
+       reverse push order: a shadow root is walked first (finding nested
+       roots), then sanitized, then template content, then the children. */
     const stack: Array<{ node: Node | null; shadow: DocumentFragment | null }> =
       [{ node: root, shadow: null }];
 
     while (stack.length > 0) {
       const item = stack.pop();
 
-      /* Deferred shadow-DOM sanitisation: runs after its subtree was walked. */
       if (item.shadow) {
         _sanitizeShadowDOM(item.shadow);
         continue;
@@ -2775,9 +2983,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       const nodeType = _readNodeType(node);
       const isElement = nodeType === NODE_TYPE.element;
 
-      /* (pushed last → processed first) Children, snapshotted in reverse so
-         the first child is processed first. Snapshotting matters because a
-         hook may detach siblings mid-walk. */
+      // Children, copied now since hooks may detach siblings mid-walk
       const childNodes = getChildNodes(node);
       if (childNodes) {
         for (let i = childNodes.length - 1; i >= 0; --i) {
@@ -2785,9 +2991,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         }
       }
 
-      /* (pushed before children → processed after them, matching the old
-         "template content last" order) When the node is a <template>,
-         descend into its content. */
+      // Template content
       if (isElement) {
         const rootName = getNodeName ? getNodeName(node) : null;
         if (
@@ -2801,17 +3005,10 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         }
       }
 
-      /* Shadow root (processed first): walk its subtree, then sanitise it.
-         Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
-         rather than `instanceof DocumentFragment`, which is realm-bound and
-         silently skipped foreign-realm shadow roots (e.g.
-         iframe.contentDocument attachShadow). */
+      // Shadow root: walk it, then sanitize it (realm-safe nodeType check)
       if (isElement) {
         const sr = getShadowRoot(node);
         if (_isDocumentFragment(sr)) {
-          /* Push the deferred sanitise first so it pops after the shadow
-             walk we push next, i.e. nested shadow roots are discovered
-             before this one is sanitised. */
           stack.push({ node: null, shadow: sr }, { node: sr, shadow: null });
         }
       }
@@ -2881,73 +3078,40 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     /* Clean up removed elements */
     DOMPurify.removed = [];
 
-    /* Resolve IN_PLACE for this call without mutating persistent config.
-       Writing the IN_PLACE closure variable here leaks under setConfig(),
-       where _parseConfig is skipped on later calls: a single string call would
-       disable in-place mode for every subsequent node call, returning a
-       sanitized copy while leaving the caller's node — which in-place callers
-       keep using and whose return value they ignore — unsanitized. REPORT-2. */
+    /* Resolved per call: setConfig() skips _parseConfig, so writing IN_PLACE
+       here would leak into later calls (REPORT-2). */
     const inPlace = IN_PLACE && typeof dirty !== 'string' && _isNode(dirty);
+    /* IN_PLACE: the caller's nodes before any hook or custom element can run,
+       and the visit tracking of an outer call this one may be nested in */
+    let inPlaceNodes: Node[] = [];
+    const outerVisited = IN_PLACE_VISITED;
 
     if (inPlace) {
-      /* Declarative-partial-updates / streaming pre-pass: sever every patch
-         linkage across the live tree BEFORE the walk, so no patch can fire
-         mid-walk and inject into an already-processed region. Runs first, so
-         it also covers the forbidden/clobbered roots that throw below. */
       _neutralizePatchLinkage(dirty as Node);
 
-      /* Do some early pre-sanitization to avoid unsafe root nodes.
-         Read nodeName through the cached prototype getter — a clobbering
-         child named "nodeName" on the form root would otherwise shadow
-         the property and let this check skip the root-allowlist
-         validation entirely. */
+      /* The root must be an allowed tag and not clobbered: a parentless root
+         cannot be removed, so it would come back unsanitized. Its name is read
+         through the cached getter, a clobbering child could shadow it. */
       const nn = _readNodeName(dirty as Node);
       if (typeof nn === 'string') {
         const tagName = transformCaseFunc(nn);
         if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
-          /* Fail closed on a live root: neutralize handlers/children before
-             throwing, exactly as the mid-walk abort path does. */
           _neutralizeRoot(dirty as Node);
-
           throw typeErrorCreate(
             'root node is forbidden and cannot be sanitized in-place'
           );
         }
       }
 
-      /* Pre-flight the root through _isClobbered. The iterator-driven
-         removal path can not detach a parent-less root: _forceRemove
-         falls through to Element.prototype.remove(), which per spec
-         is a no-op on a node with no parent. A clobbered root would
-         then survive the main loop with its attributes uninspected,
-         because _sanitizeAttributes early-returns on _isClobbered. The
-         result would be an attacker-controlled form, complete with any
-         event-handler attributes the caller passed in, handed back to
-         the application unsanitized. Refuse to sanitize such a root
-         the same way we refuse a forbidden tag. GHSA-r47g-fvhr-h676. */
       if (_isClobbered(dirty as Element)) {
-        /* Fail closed on a live clobbered root before throwing.
-           _neutralizeRoot's reads are clobber-safe (cached getters); the
-           form's non-clobbered descendants, e.g. an armed <img>, are scrubbed. */
         _neutralizeRoot(dirty as Node);
-
         throw typeErrorCreate(
           'root node is clobbered and cannot be sanitized in-place'
         );
       }
 
-      /* Sanitize attached shadow roots before the main iterator runs.
-         The iterator does not descend into shadow trees. Same fail-closed
-         barrier as the main walk (campaign-3 F2): a custom-element reaction
-         inside a shadow root could abort this pre-pass before the walk runs,
-         which would otherwise leave the entire live tree unsanitized. */
-      try {
-        _sanitizeAttachedShadowRoots(dirty as Node);
-      } catch (error) {
-        _neutralizeRoot(dirty as Node);
-
-        throw error;
-      }
+      inPlaceNodes = _collectLiveNodes(dirty as Node);
+      IN_PLACE_VISITED = setCreate();
     } else if (_isNode(dirty)) {
       /* If dirty is a DOM element, append to an empty document to avoid
          elements being stripped by the parser */
@@ -3011,65 +3175,46 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     /* Get node iterator */
     const walkRoot: Node = inPlace ? (dirty as Node) : body;
 
-    /* Now start iterating over the created document.
-       The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
-       engine/custom-element mutation can detach a node mid-walk so
-       `_forceRemove`'s parentless guard throws, aborting the loop. Without the
-       barrier the caller's in-place tree would be left half-sanitized with the
-       unvisited tail still armed. _createNodeIterator itself is inside the
-       barrier too: constructing the iterator dereferences the root's document,
-       and any failure there (e.g. an exotic/clobbered root) must still fail
-       closed rather than skip the neutralize. On any throw we fail closed -
-       strip the in-place root bare - then rethrow so the existing throw
-       contract is preserved. (String/DOM-copy paths never return the partial
-       body, so the propagating throw is already fail-closed there.) */
+    /* If anything throws, an in-place tree is stripped bare before the error
+       propagates, never left half-sanitized. */
     try {
+      if (inPlace) {
+        _sanitizeAttachedShadowRoots(dirty as Node);
+      }
+
       const nodeIterator = _createNodeIterator(walkRoot);
       while ((currentNode = nodeIterator.nextNode())) {
-        /* Sanitize tags and elements */
         _sanitizeElements(currentNode, walkRoot);
+        _sanitizeAttributes(currentNode, walkRoot);
 
-        /* Check attributes next */
-        _sanitizeAttributes(currentNode);
-
-        /* Shadow DOM detected, sanitize it.
-           Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
-           instead of instanceof, so foreign-realm <template>.content is
-           walked correctly. */
+        // Template content (realm-safe nodeType check)
         if (_isDocumentFragment(currentNode.content)) {
           _sanitizeShadowDOM(currentNode.content);
         }
       }
+
+      if (inPlace) {
+        _sanitizeUnvisitedNodes(dirty as Node, inPlaceNodes);
+      }
     } catch (error) {
       if (inPlace) {
         _neutralizeRoot(dirty as Node);
-        /* Nodes _forceRemove'd earlier in the aborted walk are already
-           detached from the root, so _neutralizeRoot's subtree pass does not
-           reach them. Defuse them too, mirroring the success-path loop below. */
-        arrayForEach(DOMPurify.removed, (entry) => {
-          if (entry.element) {
-            _neutralizeSubtree(entry.element as Node);
-          }
-        });
+        _neutralizeDiscarded(dirty as Node, inPlaceNodes);
       }
 
       throw error;
+    } finally {
+      IN_PLACE_VISITED = outerVisited;
     }
 
-    /* If we sanitized `dirty` in-place, return it. */
     if (inPlace) {
-      /* Fail-closed completion of the audit-5 F1 fix: every node removed from
-         the caller's live tree is detached but may still hold a queued
-         resource-event handler that fires in page scope after we return. The
-         move-hoist covers only disallowed-tag KEEP_CONTENT removals; strip the
-         non-allow-listed attributes off every other removed subtree (clobber,
-         mXSS, namespace, comments, KEEP_CONTENT:false, …) so those handlers are
-         cancelled before any event can fire. Runs synchronously, pre-return. */
-      arrayForEach(DOMPurify.removed, (entry) => {
-        if (entry.element) {
-          _neutralizeSubtree(entry.element as Node);
-        }
-      });
+      // A removed root has no safe state to return
+      if (_neutralizeDiscarded(dirty as Node, inPlaceNodes)) {
+        throw typeErrorCreate(
+          'a node selected for removal could not be safely returned; ' +
+            'refusing to sanitize in place'
+        );
+      }
 
       if (SAFE_FOR_TEMPLATES) {
         _scrubTemplateExpressions(dirty as Element);
@@ -3163,6 +3308,20 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
 
     const lcTag = transformCaseFunc(tag);
     const lcName = transformCaseFunc(attr);
+
+    /* Apply the same value checks sanitize() applies to an attribute when no
+       hook intervenes, so a value approved here is one sanitize() would also
+       keep: comment / raw-text closers, animated hrefs, and the jQuery 3.0
+       self-closing-tag pattern. */
+    if (
+      typeof value === 'string' &&
+      (_isUnsafeAttributeValue(attr, value) ||
+        (!ALLOW_SELF_CLOSE_IN_ATTR &&
+          regExpTest(EXPRESSIONS.SELF_CLOSING_TAG, value)))
+    ) {
+      return false;
+    }
+
     return _isValidAttribute(lcTag, lcName, value);
   };