fix: Added experiemental comment scrubbing inside attributes

cure53 · May 5, 2024 · d1d5d22 · d1d5d22
1 parent dc61232
commit d1d5d22
Show file tree

Hide file tree

Showing 9 changed files with 29 additions and 5 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -1205,6 +1205,12 @@ function createDOMPurify() {
         continue;
       }
 
+      /* Work around an issue with comments inside attribites */
+      if (regExpTest(/(--!?|])>/i, value)) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
+
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
         arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], expr => {

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1311,6 +1311,12 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
+      /* Work around an issue with comments inside attribites */
+      if (regExpTest(/(--!?|])>/i, value)) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
+
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
         arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr) => {