DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
影響: npm:dompurify <= 3.4.16 → 3.4.17
DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing. An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep . Clicking the pa…
| 情報源 | GitHub Advisory Database |
|---|---|
| 取得日時 | 2026/10/23 05:09 |
| データ | Markdown JSON |
2026/10/23 01:24、GitHub Advisory Databaseが「DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js。