fix: Fixed two conditional bypasses discovered by @parrot409 and @Slo…

…nser
cure53 · Dec 6, 2024 · f7120a3 · f7120a3
1 parent 193eef2
commit f7120a3
Show file tree

Hide file tree

Showing 10 changed files with 33 additions and 33 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1370,6 +1370,9 @@ function createDOMPurify(window = getGlobal()) {
       /* Execute a hook if present */
       _executeHook('uponSanitizeShadowNode', shadowNode, null);
 
+      /* Check attributes first */
+      _sanitizeAttributes(shadowNode);
+
       /* Sanitize tags and elements */
       if (_sanitizeElements(shadowNode)) {
         continue;
@@ -1379,9 +1382,6 @@ function createDOMPurify(window = getGlobal()) {
       if (shadowNode.content instanceof DocumentFragment) {
         _sanitizeShadowDOM(shadowNode.content);
       }
-
-      /* Check attributes, sanitize if necessary */
-      _sanitizeAttributes(shadowNode);
     }
 
     /* Execute a hook if present */
@@ -1515,6 +1515,9 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
+      /* Check attributes first */
+      _sanitizeAttributes(currentNode);
+
       /* Sanitize tags and elements */
       if (_sanitizeElements(currentNode)) {
         continue;
@@ -1525,9 +1528,6 @@ function createDOMPurify(window = getGlobal()) {
         _sanitizeShadowDOM(currentNode.content);
       }
 
-      /* Check attributes, sanitize if necessary */
-      _sanitizeAttributes(currentNode);
-
       oldNode = currentNode;
     }
 

diff --git a/src/regexp.js b/src/regexp.js
@@ -4,7 +4,7 @@ import { seal } from './utils.js';
 export const MUSTACHE_EXPR = seal(/\{\{[\w\W]*|[\w\W]*\}\}/gm); // Specify template detection regex for SAFE_FOR_TEMPLATES mode
 export const ERB_EXPR = seal(/<%[\w\W]*|[\w\W]*%>/gm);
 export const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);
-export const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]/); // eslint-disable-line no-useless-escape
+export const DATA_ATTR = seal(/^data-[\-\w.\u00B7-\uFFFF]+$/); // eslint-disable-line no-useless-escape
 export const ARIA_ATTR = seal(/^aria-[\-\w]+$/); // eslint-disable-line no-useless-escape
 export const IS_ALLOWED_URI = seal(
   /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i // eslint-disable-line no-useless-escape