dompurify 3.4.8 → 3.4.10

package/src/purify.ts

@@ -1,10 +1,7 @@
 /* eslint-disable @typescript-eslint/indent */
 
-import type {
-  TrustedHTML,
-  TrustedTypesWindow,
-} from 'trusted-types/lib/index.js';
 import type { Config, UseProfilesConfig } from './config';
+import type { DOMPurify, HooksMap, HookFunction, WindowLike } from './types';
 import * as TAGS from './tags.js';
 import * as ATTRS from './attrs.js';
 import * as EXPRESSIONS from './regexp.js';
@@ -13,6 +10,7 @@ import {
   clone,
   entries,
   freeze,
+  seal,
   arrayForEach,
   arrayIsArray,
   arrayLastIndexOf,
@@ -36,6 +34,21 @@ import {
 
 export type { Config } from './config';
 
+export type {
+  DOMPurify,
+  RemovedElement,
+  RemovedAttribute,
+  HookName,
+  NodeHook,
+  ElementHook,
+  DocumentFragmentHook,
+  UponSanitizeElementHook,
+  UponSanitizeAttributeHook,
+  UponSanitizeElementHookEvent,
+  UponSanitizeAttributeHookEvent,
+  WindowLike,
+} from './types';
+
 declare const VERSION: string;
 
 // https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
@@ -46,7 +59,7 @@ const NODE_TYPE = {
   cdataSection: 4,
   entityReference: 5, // Deprecated
   entityNode: 6, // Deprecated
-  progressingInstruction: 7,
+  processingInstruction: 7,
   comment: 8,
   document: 9,
   documentType: 10,
@@ -122,6 +135,36 @@ const _createHooksMap = function (): HooksMap {
   };
 };
 
+/**
+ * Resolve a set-valued configuration option: a fresh set built from
+ * cfg[key] when it is an own array property (seeded with a clone of
+ * options.base when given, case-normalized via options.transform),
+ * the fallback set otherwise.
+ *
+ * @param cfg the cloned, prototype-free configuration object
+ * @param key the configuration property to read
+ * @param fallback the set to use when the option is absent or not an array
+ * @param options transform and optional base set to merge into
+ * @returns the resolved set
+ */
+const _resolveSetOption = function (
+  cfg: Config,
+  key: keyof Config,
+  fallback: Record<string, boolean>,
+  options: {
+    transform: Parameters<typeof addToSet>[2];
+    base?: Record<string, boolean>;
+  }
+): Record<string, boolean> {
+  return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key])
+    ? addToSet(
+        options.base ? clone(options.base) : {},
+        cfg[key] as readonly unknown[],
+        options.transform
+      )
+    : fallback;
+};
+
 function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   const DOMPurify: DOMPurify = (root: WindowLike) => createDOMPurify(root);
 
@@ -189,30 +232,71 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   let trustedTypesPolicy;
   let emptyHTML = '';
 
+  // The instance's own internal Trusted Types policy. Unlike a caller-supplied
+  // `TRUSTED_TYPES_POLICY`, this is created at most once — Trusted Types throws
+  // on duplicate policy names — and is the only policy allowed to persist
+  // across configurations and survive `clearConfig()`.
+  let defaultTrustedTypesPolicy;
+  let defaultTrustedTypesPolicyResolved = false;
+
   // Tracks whether we are already inside a call to the configured Trusted Types
-  // policy's `createHTML`. If the supplied `TRUSTED_TYPES_POLICY.createHTML`
+  // policy (`createHTML` or `createScriptURL`). If a supplied policy callback
   // itself calls `DOMPurify.sanitize` (the cause of #1422), `sanitize` would
   // re-enter the policy and recurse until the stack overflows. We detect that
-  // re-entry and throw a clear, actionable error instead.
-  let IN_POLICY_CREATE_HTML = 0;
-  const _createTrustedHTML = function (html: string): string {
-    if (IN_POLICY_CREATE_HTML > 0) {
+  // re-entry and throw a clear, actionable error instead. The guard is shared
+  // across both callbacks, because either one re-entering `sanitize` triggers
+  // the same unbounded recursion.
+  let IN_TRUSTED_TYPES_POLICY = 0;
+  const _assertNotInTrustedTypesPolicy = function (): void {
+    if (IN_TRUSTED_TYPES_POLICY > 0) {
       throw typeErrorCreate(
-        'The configured TRUSTED_TYPES_POLICY.createHTML must not call ' +
-          'DOMPurify.sanitize, as that causes infinite recursion. Do not pass ' +
-          'a policy whose createHTML wraps DOMPurify as TRUSTED_TYPES_POLICY; ' +
-          'see the "DOMPurify and Trusted Types" section of the README.'
+        'A configured TRUSTED_TYPES_POLICY callback (createHTML or ' +
+          'createScriptURL) must not call DOMPurify.sanitize, as that causes ' +
+          'infinite recursion. Do not pass a policy whose callbacks wrap ' +
+          'DOMPurify as TRUSTED_TYPES_POLICY; see the "DOMPurify and Trusted ' +
+          'Types" section of the README.'
       );
     }
+  };
+
+  const _createTrustedHTML = function (html: string): string {
+    _assertNotInTrustedTypesPolicy();
 
-    IN_POLICY_CREATE_HTML++;
+    IN_TRUSTED_TYPES_POLICY++;
     try {
       return trustedTypesPolicy.createHTML(html);
     } finally {
-      IN_POLICY_CREATE_HTML--;
+      IN_TRUSTED_TYPES_POLICY--;
     }
   };
 
+  const _createTrustedScriptURL = function (scriptUrl: string): string {
+    _assertNotInTrustedTypesPolicy();
+
+    IN_TRUSTED_TYPES_POLICY++;
+    try {
+      return trustedTypesPolicy.createScriptURL(scriptUrl);
+    } finally {
+      IN_TRUSTED_TYPES_POLICY--;
+    }
+  };
+
+  // Lazily resolve (and cache) the instance's internal default policy.
+  // Resolution is attempted at most once: a successful `createPolicy` cannot be
+  // repeated (Trusted Types throws on duplicate names), and a failed or
+  // unsupported attempt must not be retried on every parse.
+  const _getDefaultTrustedTypesPolicy = function () {
+    if (!defaultTrustedTypesPolicyResolved) {
+      defaultTrustedTypesPolicy = _createTrustedTypesPolicy(
+        trustedTypes,
+        currentScript
+      );
+      defaultTrustedTypesPolicyResolved = true;
+    }
+
+    return defaultTrustedTypesPolicy;
+  };
+
   const {
     implementation,
     createNodeIterator,
@@ -421,6 +505,16 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     'noscript',
     'plaintext',
     'script',
+    // <selectedcontent> mirrors the selected <option>'s subtree, cloned by
+    // the UA (customizable <select>) — including any on* handlers — and the
+    // engine re-mirrors synchronously whenever a removal changes which
+    // option/selectedcontent is current, even inside DOMPurify's inert
+    // DOMParser document. Hoisting its children on removal re-inserts a fresh
+    // mirror target ahead of the walk, which the engine refills, looping
+    // forever (DoS) and amplifying output. Dropping its content on removal
+    // (rather than hoisting) breaks that cascade; the content is a duplicate
+    // of the option, which is sanitized on its own. See campaign-3 F1/F6.
+    'selectedcontent',
     'style',
     'svg',
     'template',
@@ -475,15 +569,20 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     stringToString
   );
 
-  let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [
+  const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze([
     'mi',
     'mo',
     'mn',
     'ms',
     'mtext',
   ]);
+  let MATHML_TEXT_INTEGRATION_POINTS = addToSet(
+    {},
+    DEFAULT_MATHML_TEXT_INTEGRATION_POINTS
+  );
 
-  let HTML_INTEGRATION_POINTS = addToSet({}, ['annotation-xml']);
+  const DEFAULT_HTML_INTEGRATION_POINTS = freeze(['annotation-xml']);
+  let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
 
   // Certain elements are allowed in both SVG and HTML
   // namespace. We need to specify them explicitly
@@ -549,52 +648,48 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         : stringToLowerCase;
 
     /* Set configuration parameters */
-    ALLOWED_TAGS =
-      objectHasOwnProperty(cfg, 'ALLOWED_TAGS') &&
-      arrayIsArray(cfg.ALLOWED_TAGS)
-        ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)
-        : DEFAULT_ALLOWED_TAGS;
-    ALLOWED_ATTR =
-      objectHasOwnProperty(cfg, 'ALLOWED_ATTR') &&
-      arrayIsArray(cfg.ALLOWED_ATTR)
-        ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc)
-        : DEFAULT_ALLOWED_ATTR;
-    ALLOWED_NAMESPACES =
-      objectHasOwnProperty(cfg, 'ALLOWED_NAMESPACES') &&
-      arrayIsArray(cfg.ALLOWED_NAMESPACES)
-        ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString)
-        : DEFAULT_ALLOWED_NAMESPACES;
-    URI_SAFE_ATTRIBUTES =
-      objectHasOwnProperty(cfg, 'ADD_URI_SAFE_ATTR') &&
-      arrayIsArray(cfg.ADD_URI_SAFE_ATTR)
-        ? addToSet(
-            clone(DEFAULT_URI_SAFE_ATTRIBUTES),
-            cfg.ADD_URI_SAFE_ATTR,
-            transformCaseFunc
-          )
-        : DEFAULT_URI_SAFE_ATTRIBUTES;
-    DATA_URI_TAGS =
-      objectHasOwnProperty(cfg, 'ADD_DATA_URI_TAGS') &&
-      arrayIsArray(cfg.ADD_DATA_URI_TAGS)
-        ? addToSet(
-            clone(DEFAULT_DATA_URI_TAGS),
-            cfg.ADD_DATA_URI_TAGS,
-            transformCaseFunc
-          )
-        : DEFAULT_DATA_URI_TAGS;
-    FORBID_CONTENTS =
-      objectHasOwnProperty(cfg, 'FORBID_CONTENTS') &&
-      arrayIsArray(cfg.FORBID_CONTENTS)
-        ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc)
-        : DEFAULT_FORBID_CONTENTS;
-    FORBID_TAGS =
-      objectHasOwnProperty(cfg, 'FORBID_TAGS') && arrayIsArray(cfg.FORBID_TAGS)
-        ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc)
-        : clone({});
-    FORBID_ATTR =
-      objectHasOwnProperty(cfg, 'FORBID_ATTR') && arrayIsArray(cfg.FORBID_ATTR)
-        ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc)
-        : clone({});
+    ALLOWED_TAGS = _resolveSetOption(
+      cfg,
+      'ALLOWED_TAGS',
+      DEFAULT_ALLOWED_TAGS,
+      { transform: transformCaseFunc }
+    );
+    ALLOWED_ATTR = _resolveSetOption(
+      cfg,
+      'ALLOWED_ATTR',
+      DEFAULT_ALLOWED_ATTR,
+      { transform: transformCaseFunc }
+    );
+    ALLOWED_NAMESPACES = _resolveSetOption(
+      cfg,
+      'ALLOWED_NAMESPACES',
+      DEFAULT_ALLOWED_NAMESPACES,
+      { transform: stringToString }
+    );
+    URI_SAFE_ATTRIBUTES = _resolveSetOption(
+      cfg,
+      'ADD_URI_SAFE_ATTR',
+      DEFAULT_URI_SAFE_ATTRIBUTES,
+      { transform: transformCaseFunc, base: DEFAULT_URI_SAFE_ATTRIBUTES }
+    );
+    DATA_URI_TAGS = _resolveSetOption(
+      cfg,
+      'ADD_DATA_URI_TAGS',
+      DEFAULT_DATA_URI_TAGS,
+      { transform: transformCaseFunc, base: DEFAULT_DATA_URI_TAGS }
+    );
+    FORBID_CONTENTS = _resolveSetOption(
+      cfg,
+      'FORBID_CONTENTS',
+      DEFAULT_FORBID_CONTENTS,
+      { transform: transformCaseFunc }
+    );
+    FORBID_TAGS = _resolveSetOption(cfg, 'FORBID_TAGS', clone({}), {
+      transform: transformCaseFunc,
+    });
+    FORBID_ATTR = _resolveSetOption(cfg, 'FORBID_ATTR', clone({}), {
+      transform: transformCaseFunc,
+    });
     USE_PROFILES = objectHasOwnProperty(cfg, 'USE_PROFILES')
       ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === 'object'
         ? clone(cfg.USE_PROFILES)
@@ -628,14 +723,14 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       cfg.MATHML_TEXT_INTEGRATION_POINTS &&
       typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === 'object'
         ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS)
-        : addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']); // Default built-in map
+        : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS); // Default built-in map
 
     HTML_INTEGRATION_POINTS =
       objectHasOwnProperty(cfg, 'HTML_INTEGRATION_POINTS') &&
       cfg.HTML_INTEGRATION_POINTS &&
       typeof cfg.HTML_INTEGRATION_POINTS === 'object'
         ? clone(cfg.HTML_INTEGRATION_POINTS)
-        : addToSet({}, ['annotation-xml']); // Default built-in map
+        : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS); // Default built-in map
 
     const customElementHandling =
       objectHasOwnProperty(cfg, 'CUSTOM_ELEMENT_HANDLING') &&
@@ -672,6 +767,8 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         customElementHandling.allowCustomizedBuiltInElements; // Default undefined
     }
 
+    seal(CUSTOM_ELEMENT_HANDLING);
+
     if (SAFE_FOR_TEMPLATES) {
       ALLOW_DATA_ATTR = false;
     }
@@ -783,6 +880,13 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       delete FORBID_TAGS.tbody;
     }
 
+    // Re-derive the active Trusted Types policy from this configuration on
+    // every parse. The active policy must never be sticky closure state that
+    // outlives the config that set it: a caller-supplied policy left in place
+    // after `clearConfig()` — or after a later call that supplied none, or
+    // `TRUSTED_TYPES_POLICY: null` — could sign a subsequent "default"
+    // `RETURN_TRUSTED_TYPE` result with a foreign, possibly unsafe policy.
+    // See GHSA-vxr8-fq34-vvx9.
     if (cfg.TRUSTED_TYPES_POLICY) {
       if (typeof cfg.TRUSTED_TYPES_POLICY.createHTML !== 'function') {
         throw typeErrorCreate(
@@ -796,7 +900,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         );
       }
 
-      // Overwrite existing TrustedTypes policy.
+      // A caller-supplied policy applies to this configuration only.
       const previousTrustedTypesPolicy = trustedTypesPolicy;
       trustedTypesPolicy = cfg.TRUSTED_TYPES_POLICY;
 
@@ -810,23 +914,31 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         trustedTypesPolicy = previousTrustedTypesPolicy;
         throw error;
       }
+    } else if (cfg.TRUSTED_TYPES_POLICY === null) {
+      // Explicit opt-out for this call: perform no Trusted Types signing and
+      // create nothing (so a strict `trusted-types` CSP that disallows a
+      // `dompurify` policy can still call `sanitize` from inside its own
+      // policy — see #1422). Resetting to `undefined` rather than a sticky
+      // `null` also drops any previously retained caller policy, so it cannot
+      // resurface on a later call, while still allowing the next config-less
+      // call to restore the internal default policy. See GHSA-vxr8-fq34-vvx9.
+      trustedTypesPolicy = undefined;
+      emptyHTML = '';
     } else {
-      // Uninitialized policy, attempt to initialize the internal dompurify policy.
-      if (
-        trustedTypesPolicy === undefined &&
-        cfg.TRUSTED_TYPES_POLICY !== null
-      ) {
-        trustedTypesPolicy = _createTrustedTypesPolicy(
-          trustedTypes,
-          currentScript
-        );
+      // No policy supplied: keep the currently active policy if one is set — a
+      // previously supplied policy is intentionally sticky across config-less
+      // calls — otherwise fall back to the instance's own internal policy,
+      // created at most once. (A policy supplied for a *single* call still
+      // lingers by design; what must not linger is a policy whose configuration
+      // has been torn down via `clearConfig()`, which restores the default.)
+      if (trustedTypesPolicy === undefined) {
+        trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
       }
 
-      // If creating the internal policy succeeded sign internal variables.
-      // Note: a falsy `trustedTypesPolicy` (null when policy creation failed or
-      // was skipped via `TRUSTED_TYPES_POLICY: null`, or undefined when no
-      // policy has been initialized yet) must be excluded here, otherwise we
-      // would call `.createHTML` on a non-policy and throw. See #1422.
+      // Sign internal variables only when a policy is active. A falsy policy
+      // (Trusted Types unsupported, creation failed, or an explicit opt-out)
+      // leaves `emptyHTML` as a plain string, so we never call `.createHTML` on
+      // a non-policy and throw. See #1422.
       if (trustedTypesPolicy && typeof emptyHTML === 'string') {
         emptyHTML = _createTrustedHTML('');
       }
@@ -878,6 +990,111 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     ...TAGS.mathMlDisallowed,
   ]);
 
+  /**
+   * Namespace rules for an element in the SVG namespace.
+   *
+   * @param tagName the element's lowercase tag name
+   * @param parent the (possibly simulated) parent node
+   * @param parentTagName the parent's lowercase tag name
+   * @returns true if a spec-compliant parser could produce this element
+   */
+  const _checkSvgNamespace = function (
+    tagName: string,
+    parent: { namespaceURI?: string },
+    parentTagName: string
+  ): boolean {
+    // The only way to switch from HTML namespace to SVG
+    // is via <svg>. If it happens via any other tag, then
+    // it should be killed.
+    if (parent.namespaceURI === HTML_NAMESPACE) {
+      return tagName === 'svg';
+    }
+
+    // The only way to switch from MathML to SVG is via <svg>
+    // if the parent is either <annotation-xml> or a MathML
+    // text integration point.
+    if (parent.namespaceURI === MATHML_NAMESPACE) {
+      return (
+        tagName === 'svg' &&
+        (parentTagName === 'annotation-xml' ||
+          MATHML_TEXT_INTEGRATION_POINTS[parentTagName])
+      );
+    }
+
+    // We only allow elements that are defined in SVG
+    // spec. All others are disallowed in SVG namespace.
+    return Boolean(ALL_SVG_TAGS[tagName]);
+  };
+
+  /**
+   * Namespace rules for an element in the MathML namespace.
+   *
+   * @param tagName the element's lowercase tag name
+   * @param parent the (possibly simulated) parent node
+   * @param parentTagName the parent's lowercase tag name
+   * @returns true if a spec-compliant parser could produce this element
+   */
+  const _checkMathMlNamespace = function (
+    tagName: string,
+    parent: { namespaceURI?: string },
+    parentTagName: string
+  ): boolean {
+    // The only way to switch from HTML namespace to MathML
+    // is via <math>. If it happens via any other tag, then
+    // it should be killed.
+    if (parent.namespaceURI === HTML_NAMESPACE) {
+      return tagName === 'math';
+    }
+
+    // The only way to switch from SVG to MathML is via
+    // <math> and HTML integration points
+    if (parent.namespaceURI === SVG_NAMESPACE) {
+      return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
+    }
+
+    // We only allow elements that are defined in MathML
+    // spec. All others are disallowed in MathML namespace.
+    return Boolean(ALL_MATHML_TAGS[tagName]);
+  };
+
+  /**
+   * Namespace rules for an element in the HTML namespace.
+   *
+   * @param tagName the element's lowercase tag name
+   * @param parent the (possibly simulated) parent node
+   * @param parentTagName the parent's lowercase tag name
+   * @returns true if a spec-compliant parser could produce this element
+   */
+  const _checkHtmlNamespace = function (
+    tagName: string,
+    parent: { namespaceURI?: string },
+    parentTagName: string
+  ): boolean {
+    // The only way to switch from SVG to HTML is via
+    // HTML integration points, and from MathML to HTML
+    // is via MathML text integration points
+    if (
+      parent.namespaceURI === SVG_NAMESPACE &&
+      !HTML_INTEGRATION_POINTS[parentTagName]
+    ) {
+      return false;
+    }
+
+    if (
+      parent.namespaceURI === MATHML_NAMESPACE &&
+      !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]
+    ) {
+      return false;
+    }
+
+    // We disallow tags that are specific for MathML
+    // or SVG and should never appear in HTML namespace
+    return (
+      !ALL_MATHML_TAGS[tagName] &&
+      (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName])
+    );
+  };
+
   /**
    * @param element a DOM element whose namespace is being checked
    * @returns Return false if the element has a
@@ -904,72 +1121,15 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     }
 
     if (element.namespaceURI === SVG_NAMESPACE) {
-      // The only way to switch from HTML namespace to SVG
-      // is via <svg>. If it happens via any other tag, then
-      // it should be killed.
-      if (parent.namespaceURI === HTML_NAMESPACE) {
-        return tagName === 'svg';
-      }
-
-      // The only way to switch from MathML to SVG is via`
-      // svg if parent is either <annotation-xml> or MathML
-      // text integration points.
-      if (parent.namespaceURI === MATHML_NAMESPACE) {
-        return (
-          tagName === 'svg' &&
-          (parentTagName === 'annotation-xml' ||
-            MATHML_TEXT_INTEGRATION_POINTS[parentTagName])
-        );
-      }
-
-      // We only allow elements that are defined in SVG
-      // spec. All others are disallowed in SVG namespace.
-      return Boolean(ALL_SVG_TAGS[tagName]);
+      return _checkSvgNamespace(tagName, parent, parentTagName);
     }
 
     if (element.namespaceURI === MATHML_NAMESPACE) {
-      // The only way to switch from HTML namespace to MathML
-      // is via <math>. If it happens via any other tag, then
-      // it should be killed.
-      if (parent.namespaceURI === HTML_NAMESPACE) {
-        return tagName === 'math';
-      }
-
-      // The only way to switch from SVG to MathML is via
-      // <math> and HTML integration points
-      if (parent.namespaceURI === SVG_NAMESPACE) {
-        return tagName === 'math' && HTML_INTEGRATION_POINTS[parentTagName];
-      }
-
-      // We only allow elements that are defined in MathML
-      // spec. All others are disallowed in MathML namespace.
-      return Boolean(ALL_MATHML_TAGS[tagName]);
+      return _checkMathMlNamespace(tagName, parent, parentTagName);
     }
 
     if (element.namespaceURI === HTML_NAMESPACE) {
-      // The only way to switch from SVG to HTML is via
-      // HTML integration points, and from MathML to HTML
-      // is via MathML text integration points
-      if (
-        parent.namespaceURI === SVG_NAMESPACE &&
-        !HTML_INTEGRATION_POINTS[parentTagName]
-      ) {
-        return false;
-      }
-
-      if (
-        parent.namespaceURI === MATHML_NAMESPACE &&
-        !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]
-      ) {
-        return false;
-      }
-
-      // We disallow tags that are specific for MathML
-      // or SVG and should never appear in HTML namespace
-      return (
-        !ALL_MATHML_TAGS[tagName] &&
-        (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName])
-      );
+      return _checkHtmlNamespace(tagName, parent, parentTagName);
     }
 
     // For XHTML and XML documents that support custom namespaces
@@ -999,7 +1159,81 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       // eslint-disable-next-line unicorn/prefer-dom-node-remove
       getParentNode(node).removeChild(node);
     } catch (_) {
+      /* The normal detach failed — this is reached for a parentless node
+         (getParentNode() is null, so .removeChild throws). Element.prototype
+         .remove() is itself a spec no-op on a parentless node, so a recorded
+         "removal" would otherwise hand the caller back an intact,
+         payload-bearing node (e.g. a detached IN_PLACE root the mXSS canary or
+         the style-with-element-child rule decided to kill). Fail closed by
+         throwing — exactly as a clobbered root does at the IN_PLACE entry —
+         rather than trying to "neutralize" the node via its own methods.
+         Neutralizing would mean calling getAttributeNames()/removeAttribute()
+         on the node, both of which a <form> root can clobber via a named child
+         (and _isClobbered does not even probe getAttributeNames), so the
+         neutralize step could itself be silently defeated, leaving the payload
+         intact. A throw touches only the cached, clobber-safe remove() and
+         getParentNode(). Generalizes GHSA-r47g-fvhr-h676 (clobbered-form root)
+         to every root-kill reason. REPORT-3.
+
+         This lives inside the catch, so it never fires for a normally-removed
+         in-tree node: those have a parent, removeChild() succeeds, and the
+         catch is not entered. Only a kept (parentless) root reaches here. */
       remove(node);
+
+      if (!getParentNode(node)) {
+        throw typeErrorCreate(
+          'a node selected for removal could not be detached from its tree ' +
+            'and cannot be safely returned; refusing to sanitize in place'
+        );
+      }
+    }
+  };
+
+  /**
+   * _neutralizeRoot
+   *
+   * Fail-closed teardown of an in-place root after the sanitize walk aborts
+   * (campaign-3 F2). An internal throw mid-walk — e.g. a page-registered
+   * custom element's reaction detaches a node so `_forceRemove`'s deliberate
+   * parentless guard throws, or any other re-entrant engine mutation — would
+   * otherwise leave the caller's *live* tree half-sanitized, with everything
+   * after the abort point still carrying its handlers. There is no safe way
+   * to resume the walk (the tree mutated under us), so we strip the root bare:
+   * remove every child and every attribute, then let the caller's catch see
+   * the original error. Clobber-safe (cached `remove`/`childNodes`/`attributes`
+   * getters; the root was already clobber-pre-flighted at the IN_PLACE entry).
+   *
+   * @param root the in-place root to empty
+   */
+  const _neutralizeRoot = function (root: Node): void {
+    const childNodes = getChildNodes(root);
+    if (childNodes) {
+      const snapshot: Node[] = [];
+      arrayForEach(childNodes, (child) => {
+        arrayPush(snapshot, child);
+      });
+      arrayForEach(snapshot, (child) => {
+        try {
+          remove(child);
+        } catch (_) {
+          /* Best-effort teardown; a still-attached child is handled below */
+        }
+      });
+    }
+
+    const attributes = getAttributes(root);
+    if (attributes) {
+      for (let i = attributes.length - 1; i >= 0; --i) {
+        const attribute = attributes[i];
+        const name = attribute && attribute.name;
+        if (typeof name === 'string') {
+          try {
+            (root as Element).removeAttribute(name);
+          } catch (_) {
+            /* Clobbered removeAttribute — ignore (fail-closed best effort) */
+          }
+        }
+      }
     }
   };
 
@@ -1038,6 +1272,79 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     }
   };
 
+  /**
+   * _stripDisallowedAttributes
+   *
+   * Removes every attribute the active configuration does not allow from a
+   * single element, using the same allowlist as the main attribute pass (so
+   * `on*` handlers go, but no `/^on/` blocklist is introduced). Used only to
+   * neutralise nodes that are being discarded from an in-place tree.
+   *
+   * @param element the element to strip
+   */
+  const _stripDisallowedAttributes = function (element: Element): void {
+    const attributes = getAttributes(element);
+    if (!attributes) {
+      return;
+    }
+
+    for (let i = attributes.length - 1; i >= 0; --i) {
+      const attribute = attributes[i];
+      const name = attribute && attribute.name;
+      if (typeof name !== 'string' || ALLOWED_ATTR[transformCaseFunc(name)]) {
+        continue;
+      }
+
+      try {
+        element.removeAttribute(name);
+      } catch (_) {
+        /* Clobbered removeAttribute on a doomed node — ignore */
+      }
+    }
+  };
+
+  /**
+   * _neutralizeSubtree
+   *
+   * Completes the audit-5 F1 fix across every removal path. The KEEP_CONTENT
+   * move-hoist neutralises only disallowed-tag removals; clobber, mXSS-canary,
+   * namespace, comment, processing-instruction and KEEP_CONTENT:false removals
+   * all drop their subtree wholesale via `_forceRemove`. On the IN_PLACE path
+   * those dropped nodes are detached from the caller's LIVE tree but a
+   * handler-bearing original among them (an `<img onerror>`/`<video>` that was
+   * loading) keeps its queued resource event, which fires in page scope after
+   * sanitize returns. This walks a removed subtree and strips every attribute
+   * the active configuration does not allow — so `on*` handlers are cancelled
+   * through the SAME allowlist that governs kept nodes, not a separate `/^on/`
+   * blocklist. Run synchronously before sanitize returns, i.e. before any
+   * queued event can fire. Hook-free by design: these nodes leave the output,
+   * so firing attribute hooks for them would be surprising. Clobber-safe reads;
+   * a doomed clobbered node may shadow `removeAttribute` (its own attributes are
+   * irrelevant — it is discarded — while its non-clobbered descendants, e.g.
+   * the `<img>`, are reached and scrubbed).
+   *
+   * @param root the root of a removed subtree to neutralise
+   */
+  const _neutralizeSubtree = function (root: Node): void {
+    const stack: Node[] = [root];
+
+    while (stack.length > 0) {
+      const node = stack.pop();
+      const nodeType = getNodeType ? getNodeType(node) : (node as any).nodeType;
+
+      if (nodeType === NODE_TYPE.element) {
+        _stripDisallowedAttributes(node as Element);
+      }
+
+      const childNodes = getChildNodes(node);
+      if (childNodes) {
+        for (let i = childNodes.length - 1; i >= 0; --i) {
+          stack.push(childNodes[i]);
+        }
+      }
+    }
+  };
+
   /**
    * _initDocument
    *
@@ -1131,6 +1438,21 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     );
   };
 
+  /**
+   * Replace template expression syntax (mustache, ERB, template
+   * literal) with a space; shared by all SAFE_FOR_TEMPLATES scrub
+   * sites. Order matters: mustache, then ERB, then template literal.
+   *
+   * @param value the string to scrub
+   * @returns the scrubbed string
+   */
+  const _stripTemplateExpressions = function (value: string): string {
+    value = stringReplace(value, MUSTACHE_EXPR, ' ');
+    value = stringReplace(value, ERB_EXPR, ' ');
+    value = stringReplace(value, TMPLIT_EXPR, ' ');
+    return value;
+  };
+
   /**
    * Strip template-engine expressions ({{...}}, ${...}, <%...%>) from the
    * character data of an element subtree. Used as the final safety net for
@@ -1165,23 +1487,21 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
 
     let currentNode = walker.nextNode() as CharacterData | null;
     while (currentNode) {
-      let data = currentNode.data;
-      arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr: RegExp) => {
-        data = stringReplace(data, expr, ' ');
-      });
-      currentNode.data = data;
+      currentNode.data = _stripTemplateExpressions(currentNode.data);
       currentNode = walker.nextNode() as CharacterData | null;
     }
 
     // NodeIterator does not descend into <template>.content per the DOM spec,
     // so we must explicitly recurse into each template's content fragment,
     // mirroring the approach used by _sanitizeShadowDOM.
-    const templates = node.querySelectorAll?.('template') ?? [];
-    arrayForEach(Array.from(templates), (tmpl: HTMLTemplateElement) => {
-      if (_isDocumentFragment(tmpl.content)) {
-        _scrubTemplateExpressions(tmpl.content as unknown as Element);
-      }
-    });
+    const templates = node.querySelectorAll?.('template');
+    if (templates) {
+      arrayForEach(templates, (tmpl: HTMLTemplateElement) => {
+        if (_isDocumentFragment(tmpl.content)) {
+          _scrubTemplateExpressions(tmpl.content as unknown as Element);
+        }
+      });
+    }
   };
 
   /**
@@ -1298,52 +1618,34 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     currentNode: Parameters<T>[0],
     data: Parameters<T>[1]
   ): void {
+    if (hooks.length === 0) {
+      return;
+    }
+
     arrayForEach(hooks, (hook: T) => {
       hook.call(DOMPurify, currentNode, data, CONFIG);
     });
   }
 
   /**
-   * _sanitizeElements
+   * Structural-threat checks that condemn a node regardless of the
+   * allowlists: mXSS via namespace confusion, risky CSS construction,
+   * processing instructions, markup-bearing comments. Pure predicate;
+   * the caller removes. Check order is load-bearing.
    *
-   * @protect nodeName
-   * @protect textContent
-   * @protect removeChild
-   * @param currentNode to check for permission to exist
-   * @return true if node was killed, false if left alive
+   * @param currentNode the node to inspect
+   * @param tagName the node's transformCaseFunc'd tag name
+   * @return true if the node must be removed
    */
-  const _sanitizeElements = function (currentNode: any): boolean {
-    let content = null;
-
-    /* Execute a hook if present */
-    _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
-
-    /* Check if element is clobbered or can clobber */
-    if (_isClobbered(currentNode)) {
-      _forceRemove(currentNode);
-      return true;
-    }
-
-    /* Now let's check the element's type and name */
-    const tagName = transformCaseFunc(
-      getNodeName ? getNodeName(currentNode) : currentNode.nodeName
-    );
-
-    /* Execute a hook if present */
-    _executeHooks(hooks.uponSanitizeElement, currentNode, {
-      tagName,
-      allowedTags: ALLOWED_TAGS,
-    });
-
+  const _isUnsafeNode = function (currentNode: any, tagName: string): boolean {
     /* Detect mXSS attempts abusing namespace confusion */
     if (
       SAFE_FOR_XML &&
       currentNode.hasChildNodes() &&
       !_isNode(currentNode.firstElementChild) &&
-      regExpTest(/<[/\w!]/g, currentNode.innerHTML) &&
-      regExpTest(/<[/\w!]/g, currentNode.textContent)
+      regExpTest(EXPRESSIONS.ELEMENT_MARKUP_PROBE, currentNode.textContent) &&
+      regExpTest(EXPRESSIONS.ELEMENT_MARKUP_PROBE, currentNode.innerHTML)
     ) {
-      _forceRemove(currentNode);
       return true;
     }
 
@@ -1354,13 +1656,11 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       tagName === 'style' &&
       _isNode(currentNode.firstElementChild)
     ) {
-      _forceRemove(currentNode);
       return true;
     }
 
     /* Remove any occurrence of processing instructions */
-    if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
-      _forceRemove(currentNode);
+    if (currentNode.nodeType === NODE_TYPE.processingInstruction) {
       return true;
     }
 
@@ -1368,39 +1668,47 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     if (
       SAFE_FOR_XML &&
       currentNode.nodeType === NODE_TYPE.comment &&
-      regExpTest(/<[/\w]/g, currentNode.data)
+      regExpTest(EXPRESSIONS.COMMENT_MARKUP_PROBE, currentNode.data)
     ) {
-      _forceRemove(currentNode);
       return true;
     }
 
-    /* Remove element if anything forbids its presence */
-    if (
-      FORBID_TAGS[tagName] ||
-      (!(
-        EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function &&
-        EXTRA_ELEMENT_HANDLING.tagCheck(tagName)
-      ) &&
-        !ALLOWED_TAGS[tagName])
-    ) {
-      /* Check if we have a custom element to handle */
-      if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-        if (
-          CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
-          regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)
-        ) {
-          return false;
-        }
+    return false;
+  };
 
-        if (
-          CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&
-          CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)
-        ) {
-          return false;
-        }
+  /**
+   * Handle a node whose tag is forbidden or not allowlisted: keep
+   * allowed custom elements (false return exits _sanitizeElements
+   * early - namespace/fallback checks and the afterSanitizeElements
+   * hook are intentionally skipped for kept custom elements), else
+   * hoist content per KEEP_CONTENT and remove.
+   *
+   * @param currentNode the disallowed node
+   * @param tagName the node's transformCaseFunc'd tag name
+   * @return true if the node was removed, false if kept
+   */
+  const _sanitizeDisallowedNode = function (
+    currentNode: any,
+    tagName: string
+  ): boolean {
+    /* Check if we have a custom element to handle */
+    if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
+      if (
+        CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
+        regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)
+      ) {
+        return false;
+      }
+
+      if (
+        CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&
+        CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)
+      ) {
+        return false;
       }
+    }
 
-      /* Keep content except for bad-listed elements.
+    /* Keep content except for bad-listed elements.
          Use the cached prototype getters exclusively — the previous code
          had `|| currentNode.parentNode` / `|| currentNode.childNodes`
          fallbacks, but the cached getters always return the canonical
@@ -1408,24 +1716,95 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
          path was dead in safe cases and a clobbering surface in unsafe
          ones. Falsy cached results stay falsy; the `if (childNodes &&
          parentNode)` check already gates correctly. */
-      if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
-        const parentNode = getParentNode(currentNode);
-        const childNodes = getChildNodes(currentNode);
-
-        if (childNodes && parentNode) {
-          const childCount = childNodes.length;
-
-          for (let i = childCount - 1; i >= 0; --i) {
-            const childClone = cloneNode(childNodes[i], true);
-            parentNode.insertBefore(childClone, getNextSibling(currentNode));
-          }
+    if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+      const parentNode = getParentNode(currentNode);
+      const childNodes = getChildNodes(currentNode);
+
+      if (childNodes && parentNode) {
+        const childCount = childNodes.length;
+
+        /* In-place: hoist the *original* children so the iterator visits
+             and sanitises them through the same allowlist pass as every other
+             node. The caller built the tree in the live document, so the
+             originals carry already-queued resource events (`<img onerror>`,
+             `<video>`/`<audio>` error, lazy/`onload`, …); cloning would leave
+             those originals detached but still armed, firing in page scope
+             while the returned tree looked clean. Moving is safe in-place: the
+             root is pre-validated as an allowed tag and so is never the node
+             being removed, which keeps `parentNode` inside the iterator root
+             and the relocated child inside the serialised tree.
+
+             Otherwise (string / DOM-copy paths): clone. The iterator is rooted
+             at — and the result serialised from — `body`, so a restrictive
+             ALLOWED_TAGS that removes `body` itself must leave its content in
+             place, which only cloning does; and those paths parse into an
+             inert document, so their discarded originals never had a queued
+             event to neutralise.
+
+             `childNodes` is live; a tail-to-head walk keeps `childNodes[i]`
+             valid whether we move (drops the trailing entry) or clone (leaves
+             the list intact). */
+        for (let i = childCount - 1; i >= 0; --i) {
+          const hoisted = IN_PLACE
+            ? childNodes[i]
+            : cloneNode(childNodes[i], true);
+          parentNode.insertBefore(hoisted, getNextSibling(currentNode));
         }
       }
+    }
+
+    _forceRemove(currentNode);
+    return true;
+  };
 
+  /**
+   * _sanitizeElements
+   *
+   * @protect nodeName
+   * @protect textContent
+   * @protect removeChild
+   * @param currentNode to check for permission to exist
+   * @return true if node was killed, false if left alive
+   */
+  const _sanitizeElements = function (currentNode: any): boolean {
+    /* Execute a hook if present */
+    _executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+
+    /* Check if element is clobbered or can clobber */
+    if (_isClobbered(currentNode)) {
+      _forceRemove(currentNode);
+      return true;
+    }
+
+    /* Now let's check the element's type and name */
+    const tagName = transformCaseFunc(
+      getNodeName ? getNodeName(currentNode) : currentNode.nodeName
+    );
+
+    /* Execute a hook if present */
+    _executeHooks(hooks.uponSanitizeElement, currentNode, {
+      tagName,
+      allowedTags: ALLOWED_TAGS,
+    });
+
+    /* Remove mXSS vectors, processing instructions and risky comments */
+    if (_isUnsafeNode(currentNode, tagName)) {
       _forceRemove(currentNode);
       return true;
     }
 
+    /* Remove element if anything forbids its presence */
+    if (
+      FORBID_TAGS[tagName] ||
+      (!(
+        EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function &&
+        EXTRA_ELEMENT_HANDLING.tagCheck(tagName)
+      ) &&
+        !ALLOWED_TAGS[tagName])
+    ) {
+      return _sanitizeDisallowedNode(currentNode, tagName);
+    }
+
     /* Check whether element has a valid namespace.
        Realm-safe check (GHSA-hpcv-96wg-7vj8): use the cached Node.prototype
        nodeType getter rather than `instanceof Element`, which is realm-
@@ -1443,7 +1822,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       (tagName === 'noscript' ||
         tagName === 'noembed' ||
         tagName === 'noframes') &&
-      regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)
+      regExpTest(EXPRESSIONS.FALLBACK_TAG_CLOSE, currentNode.innerHTML)
     ) {
       _forceRemove(currentNode);
       return true;
@@ -1452,11 +1831,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     /* Sanitize element content to be template-safe */
     if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
       /* Get the element's text content */
-      content = currentNode.textContent;
-
-      arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr: RegExp) => {
-        content = stringReplace(content, expr, ' ');
-      });
+      const content = _stripTemplateExpressions(currentNode.textContent);
 
       if (currentNode.textContent !== content) {
         arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
@@ -1507,16 +1882,12 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         (https://html.spec.whatwg.org/multipage/dom.html#embedding-custom-non-visible-data-with-the-data-*-attributes)
         XML-compatible (https://html.spec.whatwg.org/multipage/infrastructure.html#xml-compatible and http://www.w3.org/TR/xml/#d0e804)
         We don't need to check the value; it's always URI safe. */
-    if (
-      ALLOW_DATA_ATTR &&
-      !FORBID_ATTR[lcName] &&
-      regExpTest(DATA_ATTR, lcName)
-    ) {
+    if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR, lcName)) {
       // This attribute is safe
     } else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR, lcName)) {
       // This attribute is safe
       /* Otherwise, check the name is permitted */
-    } else if (!nameIsPermitted || FORBID_ATTR[lcName]) {
+    } else if (!nameIsPermitted) {
       if (
         // First condition does a very basic check if a) it's basically a valid custom element tagname AND
         // b) if the tagName passes whatever the user has configured for CUSTOM_ELEMENT_HANDLING.tagNameCheck
@@ -1610,6 +1981,85 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     );
   };
 
+  /**
+   * Wrap an attribute value in the matching Trusted Types object when
+   * the active policy requires it. Namespaced attributes pass through
+   * unchanged (no TT support yet, see
+   * https://bugs.chromium.org/p/chromium/issues/detail?id=1305293).
+   *
+   * @param lcTag lowercase tag name of the containing element
+   * @param lcName lowercase attribute name
+   * @param namespaceURI the attribute's namespace, if any
+   * @param value the attribute value to wrap
+   * @return the value, wrapped when Trusted Types demand it
+   */
+  const _applyTrustedTypesToAttribute = function (
+    lcTag: string,
+    lcName: string,
+    namespaceURI: string | null,
+    value: string
+  ): string {
+    if (
+      trustedTypesPolicy &&
+      typeof trustedTypes === 'object' &&
+      typeof trustedTypes.getAttributeType === 'function' &&
+      !namespaceURI
+    ) {
+      switch (trustedTypes.getAttributeType(lcTag, lcName)) {
+        case 'TrustedHTML': {
+          return _createTrustedHTML(value);
+        }
+
+        case 'TrustedScriptURL': {
+          return _createTrustedScriptURL(value);
+        }
+
+        default: {
+          break;
+        }
+      }
+    }
+
+    return value;
+  };
+
+  /**
+   * Write a modified attribute value back onto the element. On
+   * success, re-probe for clobbering introduced by the new value and
+   * remove the element when found; otherwise pop the removal entry
+   * recorded by the earlier _removeAttribute (long-standing pairing
+   * with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+   * failure, remove the attribute instead.
+   *
+   * @param currentNode the element carrying the attribute
+   * @param name the attribute name as present on the element
+   * @param namespaceURI the attribute's namespace, if any
+   * @param value the new attribute value
+   */
+  const _setAttributeValue = function (
+    currentNode: Element,
+    name: string,
+    namespaceURI: string | null,
+    value: string
+  ): void {
+    try {
+      if (namespaceURI) {
+        currentNode.setAttributeNS(namespaceURI, name, value);
+      } else {
+        /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
+        currentNode.setAttribute(name, value);
+      }
+
+      if (_isClobbered(currentNode)) {
+        _forceRemove(currentNode);
+      } else {
+        arrayPop(DOMPurify.removed);
+      }
+    } catch (_) {
+      _removeAttribute(name, currentNode);
+    }
+  };
+
   /**
    * _sanitizeAttributes
    *
@@ -1639,6 +2089,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       forceKeepAttr: undefined,
     };
     let l = attributes.length;
+    const lcTag = transformCaseFunc(currentNode.nodeName);
 
     /* Go backwards over all attributes; safely remove bad ones */
     while (l--) {
@@ -1691,7 +2142,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         continue;
       }
 
-      /* Did the hooks approve of the attribute? */
+      /* Did the hooks force-keep the attribute? */
       if (hookEvent.forceKeepAttr) {
         continue;
       }
@@ -1703,70 +2154,31 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       }
 
       /* Work around a security issue in jQuery 3.0 */
-      if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
+      if (
+        !ALLOW_SELF_CLOSE_IN_ATTR &&
+        regExpTest(EXPRESSIONS.SELF_CLOSING_TAG, value)
+      ) {
         _removeAttribute(name, currentNode);
         continue;
       }
 
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
-        arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr: RegExp) => {
-          value = stringReplace(value, expr, ' ');
-        });
+        value = _stripTemplateExpressions(value);
       }
 
       /* Is `value` valid for this attribute? */
-      const lcTag = transformCaseFunc(currentNode.nodeName);
       if (!_isValidAttribute(lcTag, lcName, value)) {
         _removeAttribute(name, currentNode);
         continue;
       }
 
       /* Handle attributes that require Trusted Types */
-      if (
-        trustedTypesPolicy &&
-        typeof trustedTypes === 'object' &&
-        typeof trustedTypes.getAttributeType === 'function'
-      ) {
-        if (namespaceURI) {
-          /* Namespaces are not yet supported, see https://bugs.chromium.org/p/chromium/issues/detail?id=1305293 */
-        } else {
-          switch (trustedTypes.getAttributeType(lcTag, lcName)) {
-            case 'TrustedHTML': {
-              value = _createTrustedHTML(value);
-              break;
-            }
-
-            case 'TrustedScriptURL': {
-              value = trustedTypesPolicy.createScriptURL(value);
-              break;
-            }
-
-            default: {
-              break;
-            }
-          }
-        }
-      }
+      value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
 
       /* Handle invalid data-* attribute set by try-catching it */
       if (value !== initValue) {
-        try {
-          if (namespaceURI) {
-            currentNode.setAttributeNS(namespaceURI, name, value);
-          } else {
-            /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
-            currentNode.setAttribute(name, value);
-          }
-
-          if (_isClobbered(currentNode)) {
-            _forceRemove(currentNode);
-          } else {
-            arrayPop(DOMPurify.removed);
-          }
-        } catch (_) {
-          _removeAttribute(name, currentNode);
-        }
+        _setAttributeValue(currentNode, name, namespaceURI, value);
       }
     }
 
@@ -1818,9 +2230,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         ? getNodeType(shadowNode)
         : shadowNode.nodeType;
       if (shadowNodeType === NODE_TYPE.element) {
-        const innerSr = getShadowRoot
-          ? getShadowRoot(shadowNode)
-          : (shadowNode as Element).shadowRoot;
+        const innerSr = getShadowRoot(shadowNode);
         if (_isDocumentFragment(innerSr)) {
           _sanitizeAttachedShadowRoots(innerSr);
           _sanitizeShadowDOM(innerSr);
@@ -1852,57 +2262,76 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
    * @param root the subtree root to walk for attached shadow roots
    */
   const _sanitizeAttachedShadowRoots = function (root: Node): void {
-    const nodeType = getNodeType ? getNodeType(root) : (root as any).nodeType;
-
-    if (nodeType === NODE_TYPE.element) {
-      const sr = getShadowRoot
-        ? getShadowRoot(root)
-        : (root as Element).shadowRoot;
-      // Realm-safe check (GHSA-hpcv-96wg-7vj8): use nodeType-based
-      // detection rather than `instanceof DocumentFragment`, which is
-      // realm-bound and silently skipped shadow roots whose host element
-      // belonged to a foreign realm (e.g. iframe.contentDocument
-      // attachShadow). A foreign-realm ShadowRoot extends the foreign
-      // realm's DocumentFragment, not ours, so the old instanceof check
-      // returned false and the shadow subtree was never walked.
-      if (_isDocumentFragment(sr)) {
-        // Recurse first so that nested shadow roots are reached even if
-        // _sanitizeShadowDOM removes hosts at this level.
-        _sanitizeAttachedShadowRoots(sr);
-        _sanitizeShadowDOM(sr);
+    /* Iterative (explicit stack) rather than per-child recursion. DOM APIs
+       impose no depth cap, so an attacker-shaped tree (JSON/CRDT/editor data
+       built straight into the DOM — the IN_PLACE surface) deeper than the JS
+       call-stack budget would otherwise overflow native recursion here and
+       throw at the IN_PLACE entry pre-pass, before a single node is
+       sanitized, leaving the caller's live tree untouched (fail-open). See
+       campaign-3 F4. A heap stack keeps depth off the call stack.
+
+       Each work item is either a node to descend into, or a deferred
+       `_sanitizeShadowDOM` for an already-walked shadow root. The deferred
+       form preserves the original post-order discipline: a shadow root's
+       nested shadow roots are discovered before the outer shadow is
+       sanitized (which may remove hosts). Pushes are in reverse of the
+       desired processing order (LIFO): template content, then children, then
+       the shadow-sanitize, then the shadow walk — so the order matches the
+       previous recursion exactly. */
+    const stack: Array<{ node: Node | null; shadow: DocumentFragment | null }> =
+      [{ node: root, shadow: null }];
+
+    while (stack.length > 0) {
+      const item = stack.pop();
+
+      /* Deferred shadow-DOM sanitisation: runs after its subtree was walked. */
+      if (item.shadow) {
+        _sanitizeShadowDOM(item.shadow);
+        continue;
       }
-    }
-
-    // Snapshot children before recursing. Sanitization of one subtree
-    // (e.g. via an uponSanitizeShadowNode hook) may detach siblings,
-    // and naive nextSibling traversal would silently skip the rest of
-    // the list once a node is detached.
-    const childNodes = getChildNodes
-      ? getChildNodes(root)
-      : (root as Element).childNodes;
-    if (!childNodes) {
-      return;
-    }
 
-    const snapshot: Node[] = [];
-    arrayForEach(childNodes, (child) => {
-      arrayPush(snapshot, child);
-    });
+      const node = item.node;
+      const nodeType = getNodeType ? getNodeType(node) : (node as any).nodeType;
+      const isElement = nodeType === NODE_TYPE.element;
+
+      /* (pushed last → processed first) Children, snapshotted in reverse so
+         the first child is processed first. Snapshotting matters because a
+         hook may detach siblings mid-walk. */
+      const childNodes = getChildNodes(node);
+      if (childNodes) {
+        for (let i = childNodes.length - 1; i >= 0; --i) {
+          stack.push({ node: childNodes[i], shadow: null });
+        }
+      }
 
-    for (const child of snapshot) {
-      _sanitizeAttachedShadowRoots(child);
-    }
+      /* (pushed before children → processed after them, matching the old
+         "template content last" order) When the node is a <template>,
+         descend into its content. */
+      if (isElement) {
+        const rootName = getNodeName ? getNodeName(node) : null;
+        if (
+          typeof rootName === 'string' &&
+          transformCaseFunc(rootName) === 'template'
+        ) {
+          const content = (node as HTMLTemplateElement).content;
+          if (_isDocumentFragment(content)) {
+            stack.push({ node: content, shadow: null });
+          }
+        }
+      }
 
-    /* When the root is a <template>, also descend into root.content */
-    if (nodeType === NODE_TYPE.element) {
-      const rootName = getNodeName ? getNodeName(root) : null;
-      if (
-        typeof rootName === 'string' &&
-        transformCaseFunc(rootName) === 'template'
-      ) {
-        const content = (root as HTMLTemplateElement).content;
-        if (_isDocumentFragment(content)) {
-          _sanitizeAttachedShadowRoots(content);
+      /* Shadow root (processed first): walk its subtree, then sanitise it.
+         Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
+         rather than `instanceof DocumentFragment`, which is realm-bound and
+         silently skipped foreign-realm shadow roots (e.g.
+         iframe.contentDocument attachShadow). */
+      if (isElement) {
+        const sr = getShadowRoot(node);
+        if (_isDocumentFragment(sr)) {
+          /* Push the deferred sanitise first so it pops after the shadow
+             walk we push next, i.e. nested shadow roots are discovered
+             before this one is sanitised. */
+          stack.push({ node: null, shadow: sr }, { node: sr, shadow: null });
         }
       }
     }
@@ -1944,12 +2373,15 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     /* Clean up removed elements */
     DOMPurify.removed = [];
 
-    /* Check if dirty is correctly typed for IN_PLACE */
-    if (typeof dirty === 'string') {
-      IN_PLACE = false;
-    }
+    /* Resolve IN_PLACE for this call without mutating persistent config.
+       Writing the IN_PLACE closure variable here leaks under setConfig(),
+       where _parseConfig is skipped on later calls: a single string call would
+       disable in-place mode for every subsequent node call, returning a
+       sanitized copy while leaving the caller's node — which in-place callers
+       keep using and whose return value they ignore — unsanitized. REPORT-2. */
+    const inPlace = IN_PLACE && typeof dirty !== 'string' && _isNode(dirty);
 
-    if (IN_PLACE) {
+    if (inPlace) {
       /* Do some early pre-sanitization to avoid unsafe root nodes.
          Read nodeName through the cached prototype getter — a clobbering
          child named "nodeName" on the form root would otherwise shadow
@@ -1984,8 +2416,17 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       }
 
       /* Sanitize attached shadow roots before the main iterator runs.
-         The iterator does not descend into shadow trees. */
-      _sanitizeAttachedShadowRoots(dirty as Node);
+         The iterator does not descend into shadow trees. Same fail-closed
+         barrier as the main walk (campaign-3 F2): a custom-element reaction
+         inside a shadow root could abort this pre-pass before the walk runs,
+         which would otherwise leave the entire live tree unsanitized. */
+      try {
+        _sanitizeAttachedShadowRoots(dirty as Node);
+      } catch (error) {
+        _neutralizeRoot(dirty as Node);
+
+        throw error;
+      }
     } else if (_isNode(dirty)) {
       /* If dirty is a DOM element, append to an empty document to avoid
          elements being stripped by the parser */
@@ -2039,27 +2480,56 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
     }
 
     /* Get node iterator */
-    const nodeIterator = _createNodeIterator(IN_PLACE ? dirty : body);
-
-    /* Now start iterating over the created document */
-    while ((currentNode = nodeIterator.nextNode())) {
-      /* Sanitize tags and elements */
-      _sanitizeElements(currentNode);
-
-      /* Check attributes next */
-      _sanitizeAttributes(currentNode);
-
-      /* Shadow DOM detected, sanitize it.
-         Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
-         instead of instanceof, so foreign-realm <template>.content is
-         walked correctly. */
-      if (_isDocumentFragment(currentNode.content)) {
-        _sanitizeShadowDOM(currentNode.content);
+    const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+
+    /* Now start iterating over the created document.
+       The walk runs inside an exception barrier (campaign-3 F2): a re-entrant
+       engine/custom-element mutation can detach a node mid-walk so
+       `_forceRemove`'s parentless guard throws, aborting the loop. Without the
+       barrier the caller's in-place tree would be left half-sanitized with the
+       unvisited tail still armed. On any throw we fail closed — strip the
+       in-place root bare — then rethrow so the existing throw contract is
+       preserved. (String/DOM-copy paths never return the partial body, so the
+       propagating throw is already fail-closed there.) */
+    try {
+      while ((currentNode = nodeIterator.nextNode())) {
+        /* Sanitize tags and elements */
+        _sanitizeElements(currentNode);
+
+        /* Check attributes next */
+        _sanitizeAttributes(currentNode);
+
+        /* Shadow DOM detected, sanitize it.
+           Realm-safe check (GHSA-hpcv-96wg-7vj8): nodeType-based detection
+           instead of instanceof, so foreign-realm <template>.content is
+           walked correctly. */
+        if (_isDocumentFragment(currentNode.content)) {
+          _sanitizeShadowDOM(currentNode.content);
+        }
+      }
+    } catch (error) {
+      if (inPlace) {
+        _neutralizeRoot(dirty as Node);
       }
+
+      throw error;
     }
 
     /* If we sanitized `dirty` in-place, return it. */
-    if (IN_PLACE) {
+    if (inPlace) {
+      /* Fail-closed completion of the audit-5 F1 fix: every node removed from
+         the caller's live tree is detached but may still hold a queued
+         resource-event handler that fires in page scope after we return. The
+         move-hoist covers only disallowed-tag KEEP_CONTENT removals; strip the
+         non-allow-listed attributes off every other removed subtree (clobber,
+         mXSS, namespace, comments, KEEP_CONTENT:false, …) so those handlers are
+         cancelled before any event can fire. Runs synchronously, pre-return. */
+      arrayForEach(DOMPurify.removed, (entry) => {
+        if (entry.element) {
+          _neutralizeSubtree(entry.element as Node);
+        }
+      });
+
       if (SAFE_FOR_TEMPLATES) {
         _scrubTemplateExpressions(dirty as Element);
       }
@@ -2115,9 +2585,7 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
 
     /* Sanitize final string template-safe */
     if (SAFE_FOR_TEMPLATES) {
-      arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr: RegExp) => {
-        serializedHTML = stringReplace(serializedHTML, expr, ' ');
-      });
+      serializedHTML = _stripTemplateExpressions(serializedHTML);
     }
 
     return trustedTypesPolicy && RETURN_TRUSTED_TYPE
@@ -2133,6 +2601,13 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
   DOMPurify.clearConfig = function () {
     CONFIG = null;
     SET_CONFIG = false;
+
+    // Drop any caller-supplied Trusted Types policy so it cannot poison later
+    // `RETURN_TRUSTED_TYPE` output. The internal default policy (cached, and
+    // never recreated — Trusted Types throws on duplicate names) is restored by
+    // the next `_parseConfig`. See GHSA-vxr8-fq34-vvx9.
+    trustedTypesPolicy = defaultTrustedTypesPolicy;
+    emptyHTML = '';
   };
 
   DOMPurify.isValidAttribute = function (tag, attr, value) {
@@ -2184,352 +2659,3 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
 }
 
 export default createDOMPurify();
-
-export interface DOMPurify {
-  /**
-   * Creates a DOMPurify instance using the given window-like object. Defaults to `window`.
-   */
-  (root?: WindowLike): DOMPurify;
-
-  /**
-   * Version label, exposed for easier checks
-   * if DOMPurify is up to date or not
-   */
-  version: string;
-
-  /**
-   * Array of elements that DOMPurify removed during sanitation.
-   * Empty if nothing was removed.
-   */
-  removed: Array<RemovedElement | RemovedAttribute>;
-
-  /**
-   * Expose whether this browser supports running the full DOMPurify.
-   */
-  isSupported: boolean;
-
-  /**
-   * Set the configuration once.
-   *
-   * @param cfg configuration object
-   */
-  setConfig(cfg?: Config): void;
-
-  /**
-   * Removes the configuration.
-   */
-  clearConfig(): void;
-
-  /**
-   * Provides core sanitation functionality.
-   *
-   * @param dirty string or DOM node
-   * @param cfg object
-   * @returns Sanitized TrustedHTML.
-   */
-  sanitize(
-    dirty: string | Node,
-    cfg: Config & { RETURN_TRUSTED_TYPE: true }
-  ): TrustedHTML;
-
-  /**
-   * Provides core sanitation functionality.
-   *
-   * @param dirty DOM node
-   * @param cfg object
-   * @returns Sanitized DOM node.
-   */
-  sanitize(dirty: Node, cfg: Config & { IN_PLACE: true }): Node;
-
-  /**
-   * Provides core sanitation functionality.
-   *
-   * @param dirty string or DOM node
-   * @param cfg object
-   * @returns Sanitized DOM node.
-   */
-  sanitize(dirty: string | Node, cfg: Config & { RETURN_DOM: true }): Node;
-
-  /**
-   * Provides core sanitation functionality.
-   *
-   * @param dirty string or DOM node
-   * @param cfg object
-   * @returns Sanitized document fragment.
-   */
-  sanitize(
-    dirty: string | Node,
-    cfg: Config & { RETURN_DOM_FRAGMENT: true }
-  ): DocumentFragment;
-
-  /**
-   * Provides core sanitation functionality.
-   *
-   * @param dirty string or DOM node
-   * @param cfg object
-   * @returns Sanitized string.
-   */
-  sanitize(dirty: string | Node, cfg?: Config): string;
-
-  /**
-   * Checks if an attribute value is valid.
-   * Uses last set config, if any. Otherwise, uses config defaults.
-   *
-   * @param tag Tag name of containing element.
-   * @param attr Attribute name.
-   * @param value Attribute value.
-   * @returns Returns true if `value` is valid. Otherwise, returns false.
-   */
-  isValidAttribute(tag: string, attr: string, value: string): boolean;
-
-  /**
-   * Adds a DOMPurify hook.
-   *
-   * @param entryPoint entry point for the hook to add
-   * @param hookFunction function to execute
-   */
-  addHook(entryPoint: BasicHookName, hookFunction: NodeHook): void;
-
-  /**
-   * Adds a DOMPurify hook.
-   *
-   * @param entryPoint entry point for the hook to add
-   * @param hookFunction function to execute
-   */
-  addHook(entryPoint: ElementHookName, hookFunction: ElementHook): void;
-
-  /**
-   * Adds a DOMPurify hook.
-   *
-   * @param entryPoint entry point for the hook to add
-   * @param hookFunction function to execute
-   */
-  addHook(
-    entryPoint: DocumentFragmentHookName,
-    hookFunction: DocumentFragmentHook
-  ): void;
-
-  /**
-   * Adds a DOMPurify hook.
-   *
-   * @param entryPoint entry point for the hook to add
-   * @param hookFunction function to execute
-   */
-  addHook(
-    entryPoint: 'uponSanitizeElement',
-    hookFunction: UponSanitizeElementHook
-  ): void;
-
-  /**
-   * Adds a DOMPurify hook.
-   *
-   * @param entryPoint entry point for the hook to add
-   * @param hookFunction function to execute
-   */
-  addHook(
-    entryPoint: 'uponSanitizeAttribute',
-    hookFunction: UponSanitizeAttributeHook
-  ): void;
-
-  /**
-   * Remove a DOMPurify hook at a given entryPoint
-   * (pops it from the stack of hooks if hook not specified)
-   *
-   * @param entryPoint entry point for the hook to remove
-   * @param hookFunction optional specific hook to remove
-   * @returns removed hook
-   */
-  removeHook(
-    entryPoint: BasicHookName,
-    hookFunction?: NodeHook
-  ): NodeHook | undefined;
-
-  /**
-   * Remove a DOMPurify hook at a given entryPoint
-   * (pops it from the stack of hooks if hook not specified)
-   *
-   * @param entryPoint entry point for the hook to remove
-   * @param hookFunction optional specific hook to remove
-   * @returns removed hook
-   */
-  removeHook(
-    entryPoint: ElementHookName,
-    hookFunction?: ElementHook
-  ): ElementHook | undefined;
-
-  /**
-   * Remove a DOMPurify hook at a given entryPoint
-   * (pops it from the stack of hooks if hook not specified)
-   *
-   * @param entryPoint entry point for the hook to remove
-   * @param hookFunction optional specific hook to remove
-   * @returns removed hook
-   */
-  removeHook(
-    entryPoint: DocumentFragmentHookName,
-    hookFunction?: DocumentFragmentHook
-  ): DocumentFragmentHook | undefined;
-
-  /**
-   * Remove a DOMPurify hook at a given entryPoint
-   * (pops it from the stack of hooks if hook not specified)
-   *
-   * @param entryPoint entry point for the hook to remove
-   * @param hookFunction optional specific hook to remove
-   * @returns removed hook
-   */
-  removeHook(
-    entryPoint: 'uponSanitizeElement',
-    hookFunction?: UponSanitizeElementHook
-  ): UponSanitizeElementHook | undefined;
-
-  /**
-   * Remove a DOMPurify hook at a given entryPoint
-   * (pops it from the stack of hooks if hook not specified)
-   *
-   * @param entryPoint entry point for the hook to remove
-   * @param hookFunction optional specific hook to remove
-   * @returns removed hook
-   */
-  removeHook(
-    entryPoint: 'uponSanitizeAttribute',
-    hookFunction?: UponSanitizeAttributeHook
-  ): UponSanitizeAttributeHook | undefined;
-
-  /**
-   * Removes all DOMPurify hooks at a given entryPoint
-   *
-   * @param entryPoint entry point for the hooks to remove
-   */
-  removeHooks(entryPoint: HookName): void;
-
-  /**
-   * Removes all DOMPurify hooks.
-   */
-  removeAllHooks(): void;
-}
-
-/**
- * An element removed by DOMPurify.
- */
-export interface RemovedElement {
-  /**
-   * The element that was removed.
-   */
-  element: Node;
-}
-
-/**
- * An element removed by DOMPurify.
- */
-export interface RemovedAttribute {
-  /**
-   * The attribute that was removed.
-   */
-  attribute: Attr | null;
-
-  /**
-   * The element that the attribute was removed.
-   */
-  from: Node;
-}
-
-type BasicHookName =
-  | 'beforeSanitizeElements'
-  | 'afterSanitizeElements'
-  | 'uponSanitizeShadowNode';
-type ElementHookName = 'beforeSanitizeAttributes' | 'afterSanitizeAttributes';
-type DocumentFragmentHookName =
-  | 'beforeSanitizeShadowDOM'
-  | 'afterSanitizeShadowDOM';
-type UponSanitizeElementHookName = 'uponSanitizeElement';
-type UponSanitizeAttributeHookName = 'uponSanitizeAttribute';
-
-interface HooksMap {
-  beforeSanitizeElements: NodeHook[];
-  afterSanitizeElements: NodeHook[];
-  beforeSanitizeShadowDOM: DocumentFragmentHook[];
-  uponSanitizeShadowNode: NodeHook[];
-  afterSanitizeShadowDOM: DocumentFragmentHook[];
-  beforeSanitizeAttributes: ElementHook[];
-  afterSanitizeAttributes: ElementHook[];
-  uponSanitizeElement: UponSanitizeElementHook[];
-  uponSanitizeAttribute: UponSanitizeAttributeHook[];
-}
-
-type ArrayElement<T> = T extends Array<infer U> ? U : never;
-
-type HookFunction = ArrayElement<HooksMap[keyof HooksMap]>;
-
-export type HookName =
-  | BasicHookName
-  | ElementHookName
-  | DocumentFragmentHookName
-  | UponSanitizeElementHookName
-  | UponSanitizeAttributeHookName;
-
-export type NodeHook = (
-  this: DOMPurify,
-  currentNode: Node,
-  hookEvent: null,
-  config: Config
-) => void;
-
-export type ElementHook = (
-  this: DOMPurify,
-  currentNode: Element,
-  hookEvent: null,
-  config: Config
-) => void;
-
-export type DocumentFragmentHook = (
-  this: DOMPurify,
-  currentNode: DocumentFragment,
-  hookEvent: null,
-  config: Config
-) => void;
-
-export type UponSanitizeElementHook = (
-  this: DOMPurify,
-  currentNode: Node,
-  hookEvent: UponSanitizeElementHookEvent,
-  config: Config
-) => void;
-
-export type UponSanitizeAttributeHook = (
-  this: DOMPurify,
-  currentNode: Element,
-  hookEvent: UponSanitizeAttributeHookEvent,
-  config: Config
-) => void;
-
-export interface UponSanitizeElementHookEvent {
-  tagName: string;
-  allowedTags: Record<string, boolean>;
-}
-
-export interface UponSanitizeAttributeHookEvent {
-  attrName: string;
-  attrValue: string;
-  keepAttr: boolean;
-  allowedAttributes: Record<string, boolean>;
-  forceKeepAttr: boolean | undefined;
-}
-
-/**
- * A `Window`-like object containing the properties and types that DOMPurify requires.
- */
-export type WindowLike = Pick<
-  typeof globalThis,
-  | 'DocumentFragment'
-  | 'HTMLTemplateElement'
-  | 'Node'
-  | 'Element'
-  | 'NodeFilter'
-  | 'NamedNodeMap'
-  | 'HTMLFormElement'
-  | 'DOMParser'
-> & {
-  document?: Document;
-  MozNamedAttrMap?: typeof window.NamedNodeMap;
-} & Pick<TrustedTypesWindow, 'trustedTypes'>;