fix: Adjusted the list of permitted SVG HTML integration points

test: Adjusted the tests to reflect the expected behavior
cure53 · Apr 29, 2024 · 8075b37 · 8075b37
1 parent 61b761f
commit 8075b37
Show file tree

Hide file tree

Showing 10 changed files with 12 additions and 14 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -704,7 +704,7 @@ function createDOMPurify() {
     CONFIG = cfg;
   };
   const MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, ['mi', 'mo', 'mn', 'ms', 'mtext']);
-  const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'desc', 'title', 'annotation-xml']);
+  const HTML_INTEGRATION_POINTS = addToSet({}, ['foreignobject', 'annotation-xml']);
 
   // Certain elements are allowed in both SVG and HTML
   // namespace. We need to specify them explicitly

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -643,8 +643,6 @@ function createDOMPurify(window = getGlobal()) {
 
   const HTML_INTEGRATION_POINTS = addToSet({}, [
     'foreignobject',
-    'desc',
-    'title',
     'annotation-xml',
   ]);
 

diff --git a/test/test-suite.js b/test/test-suite.js
@@ -1709,8 +1709,8 @@
           test:
             '<svg><desc><canvas></canvas><textarea></textarea></desc></svg>',
           expected: [
-            '<svg><desc><canvas></canvas><textarea></textarea></desc></svg>',
-            '<svg xmlns="http://www.w3.org/2000/svg"><desc><canvas></canvas><textarea></textarea></desc></svg>',
+            '<svg><desc></desc></svg>',
+            '<svg xmlns="http://www.w3.org/2000/svg"><desc></desc></svg>',
             '<svg xmlns="http://www.w3.org/2000/svg" />',
           ],
         },
@@ -1735,9 +1735,9 @@
         {
           test: '<svg><math></math><title><math></math></title></svg>',
           expected: [
-            '<svg><title><math></math></title></svg>',
+            '<svg><title></title></svg>',
             '<svg xmlns="http://www.w3.org/2000/svg" />',
-            '<svg xmlns="http://www.w3.org/2000/svg"><title><math></math></title></svg>',
+            '<svg xmlns="http://www.w3.org/2000/svg"><title></title></svg>',
           ],
         },
         {