fix: Attempting to fix a MathML-based mXSS pattern

cure53 · Sep 17, 2020 · ce22c8c · ce22c8c
1 parent c025bc8
commit ce22c8c
Show file tree

Hide file tree

Showing 10 changed files with 15 additions and 9 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -673,7 +673,7 @@ function createDOMPurify(window = getGlobal()) {
     /* Take care of an mXSS pattern using p, br inside svg, math */
     if (
       (tagName === 'svg' || tagName === 'math') &&
-      currentNode.querySelectorAll('p, br').length !== 0
+      currentNode.querySelectorAll('p, br, form').length !== 0
     ) {
       _forceRemove(currentNode);
       return true;

diff --git a/test/fixtures/expect.js b/test/fixtures/expect.js
@@ -1074,6 +1074,12 @@ module.exports = [
           "<svg><b><style><b></b></style></b></svg>",
           "<svg></svg><b><style><b title='</style><img>'&gt;</b>"
       ]
+  }, {
+      "title": "Tests against nesting-based mXSS behavior 1/1",
+      "payload": "<form><math><mtext></form><form><mglyph><style><img>",
+      "expected": [
+          "<form></form>"
+      ]
   }, {
       "title": "Tests against proper handling of leading whitespaces",
       "payload": " ",