Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: cure53/DOMPurify
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 3.1.0
Choose a base ref
...
head repository: cure53/DOMPurify
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 3.1.1
Choose a head ref
  • 20 commits
  • 16 files changed
  • 3 contributors

Commits on Apr 16, 2024

  1. see #939 

    docs: Updated README to be more accurate for Trusted Types use cases
    @cure53
    cure53 committed Apr 16, 2024
    Configuration menu
    Copy the full SHA
    632f122 View commit details
    Browse the repository at this point in the history

Commits on Apr 23, 2024

  1. fix: Addressed a possible bypass issue caused by deep-nesting

    @cure53
    cure53 committed Apr 23, 2024
    Configuration menu
    Copy the full SHA
    c5369f2 View commit details
    Browse the repository at this point in the history

  2. fix: Changed the behavior of the nesting counter ever so slightly

    @cure53
    cure53 committed Apr 23, 2024
    Configuration menu
    Copy the full SHA
    c725ce0 View commit details
    Browse the repository at this point in the history

  3. fix: Fixed an off-by-one with the nesting counter causing over-saniti… 

    …zation
    @cure53
    cure53 committed Apr 23, 2024
    Configuration menu
    Copy the full SHA
    f051738 View commit details
    Browse the repository at this point in the history

Commits on Apr 24, 2024

  1. fix: Added __depth field to sanitized DOM nodes for better tracking 

    test: Added tests to cover possible nesting-based mXSS on Blink & Webkit
    @cure53
    cure53 committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    ce799c3 View commit details
    Browse the repository at this point in the history

  2. fix: Slightly changed the execution order for __depth tracking

    @cure53
    cure53 committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    81d963c View commit details
    Browse the repository at this point in the history

  3. fix: Added __depth tracking for ShadowDOM and template elements as well 

    fix: Set MAX_NESTING_DEPTH to 500 for good mesaure
test: Added more tests to cover template element depth tracking
    @cure53
    cure53 committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    4299c0a View commit details
    Browse the repository at this point in the history

  4. fix: Added experimental __depth increment for copied elements 

    test: Removed Firefox 60, added Firefox 125, Chrome 124
    @cure53
    cure53 committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    65d35b8 View commit details
    Browse the repository at this point in the history

  5. fix: Fixed a faulty edit and changed the code acccordingly

    @cure53
    cure53 committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    6dbc2bd View commit details
    Browse the repository at this point in the history

  6. fix: added __removalCount to account for nodes removed from parents w… 

    …hen calculating depth

test: added more nesting-based mXSS tests and clobbering tests for __removalCount
    @icesfont
    icesfont committed Apr 24, 2024
    Configuration menu
    Copy the full SHA
    813d065 View commit details
    Browse the repository at this point in the history

Commits on Apr 25, 2024

  1. Merge pull request #941 from icesfont/fix/deep-nesting-mxss 

    fix: added __removalCount to account for nodes removed from parents w…
    @cure53
    cure53 authored Apr 25, 2024
    Configuration menu
    Copy the full SHA
    1f494b9 View commit details
    Browse the repository at this point in the history

  2. chore: Re-generated dist versions

    @cure53
    cure53 committed Apr 25, 2024
    Configuration menu
    Copy the full SHA
    ef4bbb4 View commit details
    Browse the repository at this point in the history

  3. docs: correct hook name and remove misleading comment

    @kyselberg
    kyselberg committed Apr 25, 2024
    Configuration menu
    Copy the full SHA
    6e240ec View commit details
    Browse the repository at this point in the history

  4. docs: additional info in example

    @kyselberg
    kyselberg committed Apr 25, 2024
    Configuration menu
    Copy the full SHA
    2a554b4 View commit details
    Browse the repository at this point in the history

  5. Merge pull request #942 from kyselberg/main 

    docs(README.md): correct hook name in example and remove misleading comment
    @cure53
    cure53 authored Apr 25, 2024
    Configuration menu
    Copy the full SHA
    c0d418c View commit details
    Browse the repository at this point in the history

  6. Merge pull request #943 from cure53/main 

    Merging fixes covering nesting-based mXSS into 3.x branch
    @cure53
    cure53 authored Apr 25, 2024
    Configuration menu
    Copy the full SHA
    6ea80cd View commit details
    Browse the repository at this point in the history

Commits on Apr 26, 2024

  1. fix: Set the MAX_NESTING_DEPTH to 255 for good measure and adjusted t… 

    …ests
    @cure53
    cure53 committed Apr 26, 2024
    Configuration menu
    Copy the full SHA
    809a902 View commit details
    Browse the repository at this point in the history

  2. Merge branch 'main' of github.com:cure53/DOMPurify

    @cure53
    cure53 committed Apr 26, 2024
    Configuration menu
    Copy the full SHA
    87eff29 View commit details
    Browse the repository at this point in the history

  3. chore: Preparing 3.1.1 release

    @cure53
    cure53 committed Apr 26, 2024
    Configuration menu
    Copy the full SHA
    7bbd12b View commit details
    Browse the repository at this point in the history

  4. Merge pull request #944 from cure53/main 

     Getting 3.x branch ready for 3.1.1 release
    @cure53
    cure53 authored Apr 26, 2024
    Configuration menu
    Copy the full SHA
    7a0a984 View commit details
    Browse the repository at this point in the history
Loading