Compare Versions - dompurify

npm/dompurify/Compare Versions

View on npm

From:→To:

3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh
Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1
Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade
Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes
Updated several development dependencies and CI workflow actions

3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr
Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG
Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG
Bumped several dependencies where possible

3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0
Hardened the handling of hooks removing elements, @mkrause-bee360
Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM
Hardened the handling of declarative partial updates
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs
Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
Updated up the linting tool-chain and removed now-redundant lint directives
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts
Decomposed the three largest sanitizer functions into focused helpers
Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
Reduced CI cost by running the full three-engine browser suite once per PR
Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
Documented the bench and test:happydom scripts in the README
Completed the Attack Classes & Bypass History wiki page
Bumped several dependencies where possible

3.4.9

Further improved the handling of Trusted Types config options, thanks @offset
Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb
Added more test coverage for IN_PLACE and Trusted Types related usage
Bumped several dependencies where possible
Updated README and wiki with more accurate documentation & attack samples

3.4.8

Cleaned up the repository root, renamed some and removed unneeded files
Fixed an issue with handling of Trusted Types policies, thanks @fulstadev
Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo
Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK
Bumped several dependencies where possible

3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker
Removed a problem leading to permanent hook pollution, thanks @offset
Refactored the test suite and expanded test coverage significantly

3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

3.4.4

Added the selectedcontent element to default allow-list, thanks @lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

3.4.3

Fixed an issue with handling of nested Shadow DOM trees, thanks @fishjojo1
Fixed the template regexes to be more robust against ReDoS attacks, thanks @aleung27
Updated the node iteration code to catch more Shadow DOM related issues
Updated Playwright and added Node 26 to test matrix
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

3.4.2

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom
Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

3.4.1

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
Removed a duplicate slot entry from the default HTML attribute allow-list
Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

3.4.0

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor
Fixed a problem with the type dentition patcher after Node version bump
Fixed freezing BS runs by reducing the tested browsers array
Bumped several dependencies where possible
Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

3.3.3

Fixed an engine requirement for Node 20 which caused hiccups, thanks @Rotzbua

3.3.2

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth
Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth
Bumped and removed several dependencies, thanks @Rotzbua
Fixed the test suite after bumping dependencies, thanks @Rotzbua

3.3.1

Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @MariusRumpf
Updated the ESM import syntax to be more correct, thanks @binhpv

3.3.0

Added the SVG mask-type attribute to default allow-list, thanks @prasadrajandran
Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @nelstrom
Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @Wim-Valgaeren

3.2.7

Added new attributes and elements to default allow-list, thanks @elrion018
Added tagName parameter to custom element attributeNameCheck, thanks @nelstrom
Added better check for animated href attributes, thanks @llamakko
Updated and improved the bundled types, thanks @ssi02014
Updated several tests to better align with new browser encoding behaviors
Improved the handling of potentially risky content inside CDATA elements, thanks @securityMB & @terjanq
Improved the regular expression for raw-text elements to cover textareas, thanks @securityMB & @terjanq

3.2.6

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua
Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellchen
Added better config hardening against prototype pollution, thanks @EffectRenan
Added better handling of attribute removal, thanks @michalnieruchalski-tiugo
Added better configuration for aggressive mXSS scrubbing behavior, thanks @BryanValverdeU
Removed the script that caused the fake entry CVE-2025-48050

3.2.5

Added a check to the mXSS detection regex to be more strict, thanks @masatokinugawa
Added ESM type imports in source, removes patch function, thanks @donmccurdy
Added script to verify various TypeScript configurations, thanks @reduckted
Added more modern browsers to the Karma launchers list
Added Node 23.x to tested runtimes, removed Node 17.x
Fixed the generation of source maps, thanks @reduckted
Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @hhk-png
Fixed a few typos in the README file

3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean
Added a new feature to allow specific hook removal, thanks @davecardwell
Added purify.js and purify.min.js to exports, thanks @Aetherinox
Added better logic in case no window object is president, thanks @yehuya
Updated some dependencies called out by dependabot
Updated license files etc to show the correct year

3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser
Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git
Fixed several minor issues with the type definitions, thanks again @reduckted
Fixed a minor issue with the types reference for trusted types, thanks @reduckted
Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger
Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

3.2.0

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others
Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

3.1.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa
Fixed several smaller typos in documentation and test & build files, thanks @christianhg
Added better support for Angular compiler, thanks @jeroen1602
Added several new attributes to HTML and SVG allow-list, thanks @Gigabyte5671 and @Rotzbua
Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa
Bumped several dependencies to be more up to date

3.1.6

Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @kevin-mizu
Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks @realansgar
Fixed a minor problem with the bower file pointing to the wrong dist path
Fixed several minor typos in docs, comments and comment blocks, thanks @Rotzbua
Updated several development dependencies

3.1.5

Fixed a minor issue with the dist paths in bower.js, thanks @HakumenNC
Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks @kakao-bishop-cho

3.1.4

Fixed an issue with the recently implemented isNaN checks, thanks @tulach
Added several new popover attributes to allow-list, thanks @Gigabyte5671
Fixed the tests and adjusted the test runner to cover all branches

3.1.3

Fixed several mXSS variations found by and thanks to @kevin-mizu & @Ry0taK
Added better configurability for comment scrubbing default behavior
Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu
Added better handling and readability of the nodeType property, thanks @ssi02014
Fixed some smaller issues in README and other documentation

3.1.2

Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions

3.1.1

Fixed an mXSS sanitiser bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections

Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.

3.1.0

Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
Updated README to warn about happy-dom not being safe for use with DOMPurify yet
Updated the LICENSE file to show the accurate year number
Updated several build and test dependencies

3.0.11

Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T

3.0.10

Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser
Bumped up some build and test dependencies

3.0.9

Fixed a problem with proper detection of Custom Elements, thanks @kevin-mizu
Refactored the hasOwnProperty logic, thanks @ssi02014
Removed a superfluous console.warn making HappyDom happier, thanks @HugoPoi
Modernized some of the demo hooks for better looks, thanks @Steb95

3.0.8

Fixed errors caused by conditional exports, thanks @ssi02014
Fixed a type error when working with custom element config, thanks @cpmotion

3.0.7

Added better protection against CSPP attacks, thanks @kevin-mizu
Updated browser versions for automated tests
Updated Node versions for automated tests
Refactored code base, thanks @ssi02014
Refactored build system & deployment, thanks @ssi02014

3.0.6

Refactored the core code-base and several utilities, thanks @ssi02014
Updated and fixed several sections of the README, thanks @ssi02014
Updated several outdated build and test dependencies

3.0.5

Fixed a licensing issue spotted and reported by @george-thomas-hill
Updated several build and test dependencies

3.0.4

Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @leeN
Fixed a typo with shadowrootmod which should be shadowrootmode, thanks @masatokinugawa

3.0.3

Added new TRUSTED_TYPES_POLICY configuration option, thanks @dejang
Added feDropShadow to the SVG filter allow-list, thanks @SelfMadeSystem

3.0.2

Fixed an issue with ALLOWED_URI_REGEXP not being reset, thanks @mukilane
Added mprescripts tag to allowed MathML elements, thanks @duyhai94
Added SMS URI scheme to allowed URI schemes, tanks @Kiwka
Updated supported browser versions for nicer code and smaller size, thanks @buzinas

3.0.1

Fixed a problem with improper reset of custom HTML options, thanks @ammaraskar

3.0.0

Removed all code that is for MSIE-only
Removed all tests that are for MSIE-only
Modified documentation to reflect new state of MSIE support
Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @edg2s @AndreVirtimo
Added better support for shadowrootmode, thanks @mfreed7

NOTE Please use the 2.4.4 release if you still need MSIE support, 3.0.0 comes without the MSIE overhead

2.5.9

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing

2.5.8

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser
Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

2.5.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa
Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa

2.5.6

Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @kevin-mizu
Fixed a minor problem with the bower file pointing to the wrong dist path
Updated several development dependencies

2.5.5

Fixed a minor issue with the dist paths in bower.js, thanks @HakumenNC
Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks @kakao-bishop-cho

2.5.4

Fixed a bug with latest isNaN checks affecting MSIE, thanks @tulach
Fixed the tests for MSIE and fixed related test-runner

2.5.3

Fixed several mXSS variations found by and thanks to @kevin-mizu & @Ry0taK
Added better configurability for comment scrubbing default behavior
Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu
Fixed some smaller issues in README and other documentation

2.5.2

Addressed and fixed a mXSS variation found by @kevin-mizu
Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
Updated tests for older Safari and Chrome versions

2.5.1

Fixed an mXSS sanitizer bypass reported by @icesfont
Added new code to track element nesting depth
Added new code to enforce a maximum nesting depth of 255
Added coverage tests and necessary clobbering protections

2.5.0

Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
Updated the LICENSE file to show the accurate year number
Updated several build and test dependencies

2.4.9

Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T

2.4.8

Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser

2.4.7

Fixed a licensing issue spotted and reported by @george-thomas-hill

2.4.6

Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @leeN

2.4.5

Fixed a problem with improper reset of custom HTML options, thanks @ammaraskar

2.4.4

Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @edg2s @AndreVirtimo
Added better support for shadowrootmode, thanks @mfreed7

2.4.3

Final release that is compatible with MSIE10 & MSIE 11

2.4.2

Fixed a Trusted Types sink violation with empty input and NAMESPACE , thanks @tosmolka
Fixed a Prototype Pollution issue discovered and reported by @kevin-mizu

2.4.1

Added new config option ALLOWED_NAMESPACES for better XML handling, thanks @kevin-deyoungster @tosmolka
Added better detection of template literals when SAFE_FOR_TEMPLATES is true
Fixed an exception caused by DOM clobbering, thanks @masatokinugawa
Bumped some dependencies, thanks @marcpenya-tf

2.4.0

Removed bundled types again as they caused too much trouble

2.3.12

Fixed an issue in 2.3.11 causing errors w. TypeScript, see #712, thanks @Mirco469, @brentkeller, @aryanisml

2.3.11

Added generated type definitions for better compatibility
Added SANITIZE_NAMED_PROPS config option, thanks @SoheilKhodayari
Updated README and config documentation, thanks @0xedward
Updated test suite with newer Node versions

2.3.10

Added support for sanitization of attributes requiring Trusted Types, thanks @tosmolka

2.3.9

Made TAG and ATTR config options case-sensitive when parsing XHTML, thanks @tosmolka
Bumped some dependencies, thanks @is2ei
Included github-actions in the dependabot config, thanks @nathannaveen

2.3.8

Cleaned up a minor issue with the 2.3.7 release, thanks @johnbirds

No other changes compared to 2.3.7 release, which entail:

Fixes around a bug in Safari, thanks @sybrew
Slightly improved performance, thanks @tiny-ben-tran
Lots of chores, bumps and typo fixes, thanks @is2ei
Removed unnecessary string trimming, thanks @christopherehlen

2.3.6

Added an option to allow HTML5 doctypes, thanks @tosmolka
Bumped several dependencies, thanks @is2ei
Updated documentation to cover recently added flags, thanks @is2ei

2.3.5

Performed several chores and cleanups, thanks @is2ei
Fixed a bug when working with Trusted Types, thanks @tosmolka
Fixed a bug with weird behavior on insecure nodes in IN_PLACE mode, thanks @tosmolka
Added more SVG attributes to allow-list, thanks @rzhade3

2.3.4

Added support for Custom Elements, thanks @franktopel
Added new config settings to control Custom Element sanitizing, thanks @franktopel
Added faster clobber checks, thanks @GrantGryczan
Allow-listed SVG feImage elements, thanks @ydaniv
Updated test suite
Update supported Node versions
Updated README

2.3.3

Fixed a bug in the handing of PARSER_MEDIA_TYPE spotted by @securitum-mb
Adjusted the tests for MSIE to make sure the results are as expected now

2.3.2

Added new config option PARSER_MEDIA_TYPE, thanks @tosmolka

2.3.1

Added code to make FORBID_CONTENTS setting configurable
Added role to URI-safe attributes
Added more paranoid handling for template elements

2.3.0

Added better handling of document creation on Firefox
Added better handling of version numbers in license file
Added two new browser versions to test suite config
Fixed a bug with handling of custom data attributes

2.2.9

Fixed some minor issues related to the NAMESPACE config
Fixed some minor issues relating to empty input
Fixed some minor issues relating to handling of invalid XML

2.2.8

Added NAMESPACE config option, thanks @NateScarlet
Added better fallback for older browsers & PhantomJS, thanks @albanx
Extended allow-list for SVG attributes a bit

2.2.7

Fixed handling of unsupported browsers, i.e. Safari 9 and older
Fixed various minor bugs and typos in README and examples
Added better handling of potentially harmful "is" attributes
Added better handling of lookupGetter functionality

2.2.6

Added new mXSS prevention logic created by SecurityMB

2.2.4

Fixed a new MathML-based bypass submitted by PewGrand
Fixed a new SVG-related bypass submitted by SecurityMB
Updated NodeJS CI to Node 14.x and Node 15.x
Cleaned up _forceRemove logic for better reliability

2.2.3

Fixed an mXSS issue reported by PewGrand
Fixed a minor issue with the license header
Fixed a problem with overly-eager CSS stripping
Updated the README and removed an XSS warning

2.2.2

Fixed an mXSS bypass dropped on us publicly via #482
Fixed an mXSS variation that was reported privately short after
Added dialog to permitted elements list
Fixed a small typo in the README

2.2.0

Fix a possible XSS in Chrome that is hidden behind #enable-experimental-web-platform-features, reported by @neilj and @mfreed7
Changed RETURN_DOM_IMPORT default to true to address said possible XSS
Updated README to reflect the new change and inform about the risks of manually setting RETURN_DOM_IMPORT back to false
Fixed the tests to properly address the new default

2.1.1

Removed some code targeting old Safari versions
Removed some code targeting older MS Edge versions
Re-added some code targeting older Chrome versions, thanks @terjanq
Added new tests and removed unused SAFE_FOR_JQUERY test cases
Added Node 14.x to existing test coverage

2.1.0

Fixed several possible mXSS patterns, thanks @hackvertor
Removed the SAFE_FOR_JQUERY flag (we are safe by default now for jQuery)
Removed several now useless mXSS checks
Updated the mXSS check for elements
Updated test cases to cover new sanitization strategy
Updated test website to use newer jQuery
Updated array of tested browsers and removed legacy browsers
Added "auto convert" checkbox to test website, thanks @hackvertor

2.0.17

Fixed another bypass causing mXSS by using MathML

2.0.16

Fixed an mXSS-based bypass caused by nested forms inside MathML
Fixed a security error thrown on older Chrome on Android versions, see #470

Credits for the bypass go to Michał Bentkowski (@securityMB) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix :bowing_man: :bowing_woman:

2.0.15

Added a renovated test suite, thanks @peernohell
Fixed some minor linter warnings

2.0.14

Fixed a problem with the documentMode default value

2.0.12

Fixed a minor bug when working with Trusted Types
Fixed some typos in a demo file
Fixed some wordings in code and docs

2.0.11

Fixed faulty behavior for non breaking space characters
Added ADD_DATA_URI_TAGS directive to allow customizing Data URI tag behavior

2.0.10

Fixed a dependency problem causing builds to break
Fixed a test in Chrome 83 covering Trusted Types

2.0.9

Removed a meanwhile useless parser check
Added countless new attributes to whitelist
Added whole new build and system
Added license tag to compressed files
Updated README for more clarity

2.0.8

Fixed a bypass that can be abused in case SAFE_FOR_JQUERY is used with jQuery 3.x, thanks @masatokinugawa :bowing_woman:
Added new elements to whitelist, thanks @chris-morgan
Added first layer of prototype poisoning protection, thanks @dejang
Added better controls for uponSanitizeAttribute, thanks @devinrhode2
Added demo for node removal, thanks @mikesnare

2.0.7

Fixed several mXSS vectors spotted , thanks @masatokinugawa :bowing_man:
Fixed a minor crash affecting MSIE11, see #372
Fixed some typos and adjusted the README

2.0.6

Enhanced the checks for SVG-/MathML-based mXSS
Removed several obtrusive checks and guards that are not needed any longer
Added better test coverage
Added better handling of situations where element removal causes mXSS
Added better handling of content type switches causing mXSS

2.0.5

Fixed a logical issue causing overly aggressive SVG removal spotted by @thorn0

2.0.4

Another mXSS variation was spotted by @masatokinugawa and got addressed and fixed in this release.

The fixes were reviewed and no new bypasses could be spotted at the moment. Thanks, @masatokinugawa :bowing_man: :bowing_woman:!

The sanitization logic for this kind of mXSS was changed to be less aggressive and still be able to spot all recent mXSS variations we know about right now - while also avoiding risky string matching.

Prayers and thoughts that this was the final variation. But better be on the lookout for more releases soon.

2.0.3

Fixed another mXSS variation affecting Chrome, Safari and Edge relating to HTML templates
Fixed a bug in the config parser leading to unexpected results

Credits for the bypass again go to Michał Bentkowski (@securityMB) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix :bowing_man: :bowing_woman:

2.0.2

Following the release of DOMPurify 2.0.1, a more thorough internal audit against Blink-based mXSS bugs was conducted. Several mXSS variations, spotted by @masatokinugawa were addressed and fixed. The fixes were reviewed and so far no new bypasses could be spotted.

This release manages to find what is believed to be a more holistic way to prevent mXSS bugs, specifically coming from HTML attributes and tags nested inside SVG and MathML.

Further, this release also addresses a DoS problem caused by sanitization of HTML tables when configured with potentially conflicting configuration settings.

2.0.1

Fixed a bypass affecting latest Chrome, caused by a newly discovered Chrome mXSS vulnerability
Added tests to cover implemented fixes

Credits go to Michał Bentkowski (@SecurityMB) of Securitum who spotted the bug in Chrome, turned it into a DOMPurify bypass, reported and helped verifying the fix. :bow:

2.0.0

Note: This release makes sure that, by default only string objects are returned (if not specified otherwise). This change relates to a surprising behavior in Chrome 77 - having to do with Trusted Types.

Changed the default behavior for Trusted Types (See #361)
Added a new config flag to manually enable Trusted Types support
Added support for more attributes
Fixed a minor CSP warning

1.0.11

Fixed a minor problem with persistent config flags
Fixed a problem with extraneous HTML elements
Fixed some minor issues in README and Demo
Expanded the array of permitted SVG properties
Expanded the array of permitted HTML properties

1.0.10

Fixed a possible security problem when SAFE_FOR_TEMPLATES is true (default is false), thanks @masatokinugawa
Fixed a security problem when ALLOWED_TAGS or ADD_TAGS white-lists noembed or noscript (not the default), thanks @masatokinugawa
Added better internal code hardening, thanks @choumx
Extended the SVG attribute whitelist
Added more tests
Added better browser coverage for CI via BrowserStack
Cleaned up legacy browser coverage for CI via BrowserStack

1.0.9

Extended array of tested browsers
Fixed a build error caused by npm@natives
Optimized handling of leading white-space
Squashed a memory leak
Removed a spurious alert from internal tests
Removed internal test for fixed Edge mXSS

Recommended read, covering Trusted Types and compatibility implications: https://github.com/cure53/DOMPurify#what-about-dompurify-and-trusted-types

1.0.8

Reduced installed library footprint a bit
Added better in-depth protection against Gadget XSS, thanks Jun!
Added cosmetic changes to README.md
Added several new tests

1.0.7

Fixed a bypass for older MS Edge found by Gareth Heyes / @hackvertor

1.0.6

Added new configuration flag IN_PLACE for very fast "in place" node sanitization
See #288 for additional details

1.0.5

Added better test coverage for latest browsers
Added better test coverage for latest NodeJS
Fixed a loop when ALLOW_TAGS-collides with WHOLE_DOCUMENT
Fixed a CDATA encoding bug with SAFE_FOR_JQUERY
Removed Safari 10.1/11.1 TP specific security workarounds

1.0.4

Added several more SVG attributes to white-list
Update code example to show usage with older JSDOM API
Updated jQuery version for test suite

1.0.3

Added support for more attributes (srcset, crossdorigin etc.)
Fixed overzealous DOM clobbering protection
Added support for URI regex customization via ALLOWED_URI_REGEXP

1.0.2

Made DOMPurify be fully CSP compliant

1.0.1

Fixed various issues with the node.js loader Fixed various issues with the test-suite

1.0.0

Refactored DOMPurify to ES2016/ES2017
Fixed an exception on iOS Safari
Fixed a JSDOM related bug on node.js
Fixed numerous minor issues
Added markup profiles feature

0.9.0

Fixed and worked around newly discovered variations of the Safari 10.1 - 10.2 XSS
Fixed unsafe document generation for Safari 10.1 and 10.2
Added feature test to spot additionally broken versions if necessary
Added a configuration flag to use persistent configuration

0.8.9

Fixed another aspect of the Safari XSS
Added better checks for old Firefox mXSS

0.8.7

Cleaned up after Safari emergency fix
General code and comment clean-up
Added test for Firefox mXSS issue
Added more browsers to the test array

Big thanks go to Egor Karbutov @ShikariSenpai and Egor Saltykov @ansjdnakjdnajkd for spotting and reporting the Safari issue to FastMail!

0.8.6

Fixed an XSS in Safari 10.1 and 10.2 introduced by a Safari browser bug
- On Safari 10.1 and 10.2, this now actually causes XSS. Good job, Safari. Not.
- new DOMParser().parseFromString('<svg onload=alert(document.domain)>', 'text/html');
Fixed a minor return value problem on MSIE11 (see #198)
Added new flag FORCE_BODY to enable better handling of HTML starting with style and other elements a browser might move into the header (see #199)
Added white-listing for ARIA attributes (see #203)
Fixed a minor bug in the URI white-list regex (see #200)
Fixed a bug where data URI attributes would be removed from SVG content (see #205)

0.8.5

Allowed users to pass DOM nodes for sanitization
Fixed a small problem with empty DOM fragments on MSIE11
Fixed removal of data: URIs in img-src when having whitespaces
Added more test coverage

0.8.4

Made the uponSanitizeElement and uponSanitizeAttribute hooks more powerful (see #184)
Updated MentalJS sandbox in the demo folder

0.8.3

Reduced the NPM package footprint

0.8.2

Fixed a bug with the handling of binary attributes
Added more test cases

0.8.1

Fixed a security bug when ALLOW_UNKNOWN_PROTOCOLS is true (not the default) reported and addressed by @neilj
Added more tests to cover the security fix
Added more browsers to BrowserStack test-array
Fixed some minor issue with DOM element removal log

0.8.0

Added DOMPurify.removed to allow analyzing what elements and attributes were removed
Added much better compatibility with SVG images, filters and other SVG elements
Enhanced support for Data URIs
Enhanced support for Node.js and jsdom
Enhanced tests and reduced useless output
Added automated tests for Node.js and jsdom support
Added more browsers to automated tests (Edge 13, Chrome 50, Firefox 46)
Updated documentation and credits
Fixed smaller glitches on MSIE10
Fixed an issue with Shadow DOM on mobile Chrome

0.7.4

Moved handling of URI-attributes from black-list to white-list
Optimized the code
Optimized regular expressions in use
Made all data-* attributes become URI-safe
Fixed a security bug in SAFE_FOR_TEMPLATING mode, spotted by @filedescriptor

0.7.3

Better fall-back handling for IE8 and IE9
Better compatibility with SVG filters and filter elements

0.7.2

Fixed a crash in Safari 9
Added SAFE_FOR_TEMPLATES flag to aggressively scrub template delimiters and content
Added better test coverage
Added CI coverage for MS Edge
Fixed fall-back behaviour for IE6-IE8
Enhanced and updated the documentation

0.7.1

Added better test coverage
Added tests for document.write() behavior
Added better SVG compatibility
Changed the CI log outout
Added better local testing capabilities

0.7.0

Added better compatibility for older browsers
Added better test coverage
Added /dist folder with a tested compressed DOMPurify version
Optimized internal document creation process
Optimized browser tests, now covering eight browsers
Optimized code style
Updated wiki pages and readmes

0.6.7

Security Release Please update!
Fixed a possible security issue based on a newly spotted Firefox bug (explanation below)
Replaced document.implementation by DOMParser.parseFromString()
Changed location of purify.js from / to /src
Extended the range of tested browsers on BrowserStack

Details about the Security Issue

Problem: https://bugzilla.mozilla.org/show_bug.cgi?id=1205631

Attack Scenario: The bug only manifested itself if the sanitized HTML DOMPurify created would be written to a document using document.write() or alike. Applications, that set the sanitized HTML by using innerHTML or outerHTML are not affected at all. Applications that do not allow SVG are also not affected at all.

The security issue is caused by a non-standard behavior of Gecko (the Firefox browser-engine) and a peculiar way of working with innerHTML-assignments. The following code snippets illustrate the issue:

<script>
// This is SAFE (but shouldn't be!)
document.body.innerHTML='<svg><p><style><img src="</style><img src=x onerror=alert(1)//">'
</script>


<script>
// This is UNSAFE
document.write('<svg><p><style><img src="</style><img src=x onerror=alert(1)//">')
</script>

Users who install this latest release are not affected by the bug anymore as DOMPurify fixes around the problem and mitigates the issue by not trusting Gecko's innerHTML implementation any much longer. Instead of the combination of document.implementation and doc.body.outerHTML, DOMPurify is now using the DOMParser feature available in all modern browsers.

This change is expected to be non-breaking, no API changes or other side-effects are expected.

Thanks @mozfreddyb for assisting with this fix.

0.6.6

Fixed around an MSIE/Edge bug causing freezes #89
Changed from MPL-2.0 to a dual license of Apache-2.0 and MPL-2.0
Fixed all tests for Microsoft Edge

0.6.5

New CSS sanitizer demo hook
New HTTP proxy demo hook
New URI scheme white-list demo hook
Better compatibility with Microsoft Edge
Better tolerance for custom data attributes
Fixed a crash on Firefox
Fixed id and name attribute checks
Multiple minor fixes and performance enhancements
Better documentation

0.6.4

DOMPurify can now use a custom-made window object
Added hooks can now be removed and flushed
A possible clobbering effect for
has been mitigated
Optimizations for RTE / Copy&Paste compatibility
Test suite has been optimized for better error output
Fixed a crash in Safari
Updated MentalJS library in demo hooks

0.6.3

Merged countless optimizations and beautifications by @neilj
Optimized performance thanks to @neilj
Fixed a minor bug with the RETURN_DOM flag thanks to @neilj
Detailed list of changes: https://github.com/cure53/DOMPurify/pull/52

0.6.2

Added hook demo for MentalJS JavaScript sandbox
Fixed a typo in the hook labels
Added additional hooks with meta-data objects
Fixed the tests for Project Spartan 0.10.10049

0.6.1

Fixed several security issues identified by a 3rd party code audit
Removed support for MSIE9
Enabled toStaticHTML fallback for MSIE9

0.6.0

Important: This is a feature-release, not a security update.

Added Hook API to allow custom extensions and plugins
Added config flag FORBID_TAGS to blacklist specific tags
Added config flag FORBID_ATTR to blacklist specific attributes
Added demo folder with various showcases / usage examples
Extended unit tests
Added version label to DOMPurify object

0.4.5

Fixed a minor DOM clobbering issue reported by @filedescriptor
Made sure present but empty DOM properties cannot be clobbered
Made sure that document.all cannot be clobbered by avoiding typeof

0.4.4

Fixed a bug in the clobber detection potentially leading to XSS, thanks @avlidienbrunn
Fixed an undefined error
Fixed a range error
Added a pre-test for better performance

0.4.3

Add Common JS support for browserify (Node.js is not supported yet)

0.4.2

Fixed a security issue in WebKit/Blink leading to a bypass (discovered & reported by Tom Ritter of iSEC Partners)
Extended test-suite