Closed JounQin closed 8 months ago
Nah, I don't agree. Clearing the content of unknown elements would severely affect harmless sanitization results. You can change the behavior via a hook and take care of that yourself, but we won't change anything in the core library, sorry.
But this is how browser works?
Might be, but it would harm legitimate and harmless content - so we cannot empty it.
@cure53 Then I don't quite understand this case:
Why harmless div
is removed?
Because of the <frameset>
, which causes the DIV (and almost everything else) to be removed:
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/frameset
I'm still confused, why div
must be removed due to frameset
?
Please read the link I sent you, it's all there :)
@cure53
Sorry, but I did read, but I could just find Deprecated
.
If you mean:
A frameset document has a
I think <body>${fragment}
will make sure the output always inside body and harmless?
FRAMESET is a special tag has everything being removed that cannot be in there or around it, that includes a DIV.
@cure53
I think
<body>${fragment}
will make sure the output always inside body and harmless?
Yes, again, please inform yourself about HTML, about what the body tag does, what the frameset element does - once you know that, you will see it all makes sense.
Background & Context
https://github.com/cure53/DOMPurify/blob/main/test/fixtures/expect.mjs#L886
Bug
Input
Given output
Expected output
The expected output.
Feature
The
xss
element should be considered containing all its following instead of void element which is how browser works.