escapeParameter: The sanitizer now reads tags and attributes in the same way as browsers do, and checks every attribute. A tag, a comment, or an element like <textarea> that is not closed at the end of a translation is turned into text, and so is <plaintext>. Some outputs change their form with the same result in the browser: < that does not start a tag becomes <, and onclick= inside an attribute value is kept as it is. < in the content of <textarea>, <style> and similar elements also becomes <: it looks the same in <textarea> and <title>, but stays as < in <style> and <xmp>. (#2769) See GHSA-9qc3-h48f-7h96 and GHSA-7356-3q55-jvxm.
What's Changed
🔒 Security Fixes
- fix(shared): read tags with the rules of the HTML tokenizer in sanitizeTranslatedHtml by @kazupon in #2769
Full Changelog: v11.4.18...v11.4.19