escapeParameter: The sanitizer now reads tags and attributes in the same way as browsers do, and checks every attribute. A tag, a comment, or an element like <textarea> that is not closed at the end of a translation is turned into text, and so is <plaintext>. Some outputs change their form with the same result in the browser: < that does not start a tag becomes <, and onclick= inside an attribute value is kept as it is. < in the content of <textarea>, <style> and similar elements also becomes <: it looks the same in <textarea> and <title>, but stays as < in <style> and <xmp>. (addbc3aa) See GHSA-9qc3-h48f-7h96 and GHSA-7356-3q55-jvxm.
What's Changed
🔒 Security Fixes
- fix(shared): read tags with the rules of the HTML tokenizer in sanitizeTranslatedHtml (addbc3aa)
📝️ Documentations
- docs: add I18n Support Plus to third-party tooling by @IBRAHIMDANS in #2763
New Contributors
- @IBRAHIMDANS made their first contribution in #2763
Full Changelog: v12.0.0-alpha.9...v12.0.0-alpha.10