sanitize-html 2.17.1 → 2.17.3

package/index.js

@@ -566,6 +566,15 @@ function sanitizeHtml(html, options, _recursing) {
         // your concern, don't allow them. The same is essentially true for style tags
         // which have their own collection of XSS vectors.
         result += text;
+      } else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
+        // htmlparser2 treats <textarea> and <xmp> as raw text elements and
+        // does NOT decode entities inside them. The text is already properly
+        // encoded, so pass it through without additional escaping to avoid
+        // double-encoding. Other "nonTextTags" like <option> are not raw text
+        // elements in htmlparser2, so their contents are decoded and must be
+        // escaped below like any other text (important to prevent XSS via
+        // entity-encoded payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
+        result += text;
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
         if (options.textFilter) {
@@ -671,7 +680,8 @@ function sanitizeHtml(html, options, _recursing) {
 
   if (options.disallowedTagsMode === 'escape' || options.disallowedTagsMode === 'recursiveEscape') {
     const lastParsedIndex = parser.endIndex;
-    if (lastParsedIndex != null && lastParsedIndex >= 0 && lastParsedIndex < html.length) {
+    if (lastParsedIndex != null && lastParsedIndex >= 0 &&
+        lastParsedIndex < html.length) {
       const unparsed = html.substring(lastParsedIndex);
       result += escapeHtml(unparsed);
     } else if ((lastParsedIndex == null || lastParsedIndex < 0) && html.length > 0 && result === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.17.1",
+  "version": "2.17.3",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",
@@ -24,14 +24,14 @@
   "dependencies": {
     "deepmerge": "^4.2.2",
     "escape-string-regexp": "^4.0.0",
-    "htmlparser2": "^8.0.0",
+    "htmlparser2": "^10.1.0",
     "is-plain-object": "^5.0.0",
     "parse-srcset": "^1.0.2",
     "postcss": "^8.3.11"
   },
   "devDependencies": {
     "eslint": "^9.39.1",
-    "mocha": "^10.2.0",
+    "mocha": "^11.7.5",
     "sinon": "^9.0.2",
     "eslint-config-apostrophe": "^6.0.2"
   },