Fix whitespace bypass - Githubissues

leizongmin / js-xss

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

http://jsxss.com

Other

5.19k stars 630 forks source link

Fix whitespace bypass #218

Closed TomAnthony closed 3 years ago

TomAnthony commented 3 years ago

I previously fixed a potential bypass in https://github.com/leizongmin/js-xss/pull/201/files, but missed that whitespace characters other than spaces (such as tabs and even new lines) could exhibit the same bypass potential. This PR addresses that.