fix: Added an experimental fix for an mXSS detection regex

cure53 · Feb 17, 2025 · 620b18b · 620b18b
1 parent 1c1b183
commit 620b18b
Show file tree

Hide file tree

Showing 5 changed files with 6 additions and 6 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -901,7 +901,7 @@ function createDOMPurify() {
       allowedTags: ALLOWED_TAGS
     });
     /* Detect mXSS attempts abusing namespace confusion */
-    if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w]/g, currentNode.innerHTML) && regExpTest(/<[/\w]/g, currentNode.textContent)) {
+    if (currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
       _forceRemove(currentNode);
       return true;
     }

diff --git a/dist/purify.js b/dist/purify.js