Security context

Highlights

Reflected XSS: 72 prior fixes. Scrutinize any change in this area.

src/purify.js: most-fixed (188 issues). Treat as high-risk during review.

192 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Cross-Site Scripting (XSS): Attackers exploit parser-differential nesting behavior in MathML, SVG, and template tags to cause mutation XSS (mXSS), bypass security iterations, and execute arbitrary scripts. Secure recursive walking of shadow roots, strict depth limits, and sanitizing discarded subtrees are critical.

DOM Clobbering: Malicious markup containing form elements with specific 'name' or 'id' attributes can overwrite or shadow essential DOM properties (like nodeName, parentNode, or attributes). This causes the sanitizer to process dangerous elements incorrectly. Mitigations require using safe, cached prototype getters.

Prototype Pollution: Attackers can poison built-in object, string, or array prototypes (e.g., targeting hasOwnProperty or configuration trackers) to bypass depth counters and whitelist restrictions. Defending against this requires caching prototype methods globally and cloning fallback options using null-prototype objects.