DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

影響: npm:dompurify <= 3.4.16 → 3.4.17

DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing. An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep . Clicking the pa…

在 GitHub Advisory Database 阅读

2026/10/23 01:24，GitHub Advisory Database 发布了“DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。