github cure53/DOMPurify 3.4.18
DOMPurify 3.4.18

52 minutes ago
  • Fixed a SAFE_FOR_TEMPLATES bypass where the final scrub cut through tags and let a template expression form on reparse, thanks @e1abrador
  • Fixed a direct property read in the clobbering check, thanks @trace37labs
  • Removed several entries from the SVG tag allow-list that are attributes and not elements, thanks @hackvertor
  • Added a console warning when USE_PROFILES is combined with ALLOWED_TAGS or ALLOWED_ATTR, thanks @rugk
  • Refactored the code base: removed dead code and redundant helpers, shortened comments
  • Fixed a hook-widened allow-list carrying over when the config object received by a hook was passed back to sanitize()
  • Documented that the content of closed shadow roots cannot be sanitized (README and wiki)
  • Updated the README, the wiki and the list of contributors
  • Updated several dependencies

Don't miss a new DOMPurify release

NewReleases is sending notifications on new releases.