Closed JounQin closed 8 months ago
That is what the browser does, not us - hence we cannot and won't override this :)
I'm using DOMParser, and it doesn't escape.
Are you sure?
new DOMParser().parseFromString('<div>></div>', 'text/html').body.outerHTML
// "<body><div>></div></body>"
Interesting, sorry, it seems I misread the diff at https://github.com/un-ts/domiso/blob/test/dompurify_cases/test/__snapshots__/dompurify.spec.ts.snap
Background & Context
>
as text node can not be XSSed?Bug
Input
Given output
Expected output
Feature
Don't escape unnecessary chars