fix: Fixed a possible config-specific bypass via "is" attributes, tha…

…nks @Yaniv-git
cure53 · Nov 29, 2024 · e7d44d2 · e7d44d2
1 parent cea034c
commit e7d44d2
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 9 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -777,8 +777,8 @@ function createDOMPurify() {
       });
     }
     element.removeAttribute(name);
-    // We void attribute values for unremovable "is"" attributes
-    if (name === 'is' && !ALLOWED_ATTR[name]) {
+    // We void attribute values for unremovable "is" attributes
+    if (name === 'is') {
       if (RETURN_DOM || RETURN_DOM_FRAGMENT) {
         try {
           _forceRemove(element);

diff --git a/dist/purify.js b/dist/purify.js