fix: Improved the handling of risky content inside CDATA

fix: Slightly improved the webiste attack vector loader
fix: Fixed the tests to make more sense given the recent CDATA change

Author: cure53

dist/purify.cjs.js

@@ -913,6 +913,11 @@ function createDOMPurify() {
       _forceRemove(currentNode);
       return true;
     }
+    /* Remove any kind of possibly harmful rawtext elements */
+    if (SAFE_FOR_XML && currentNode.hasChildNodes() && regExpTest(/<\/(style|script|xmp|iframe|noembed|noframes|plaintext|noscript)/gi, currentNode.textContent)) {
+      _forceRemove(currentNode);
+      return true;
+    }
     /* Remove any kind of possibly harmful comments */
     if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
       _forceRemove(currentNode);

dist/purify.cjs.js.map

@@ -1061,6 +1061,19 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
       return true;
     }
 
+    /* Remove any kind of possibly harmful rawtext elements */
+    if (
+      SAFE_FOR_XML &&
+      currentNode.hasChildNodes() &&
+      regExpTest(
+        /<\/(style|script|xmp|iframe|noembed|noframes|plaintext|noscript)/gi,
+        currentNode.textContent
+      )
+    ) {
+      _forceRemove(currentNode);
+      return true;
+    }
+
     /* Remove any kind of possibly harmful comments */
     if (
       SAFE_FOR_XML &&

dist/purify.es.mjs

@@ -278,23 +278,23 @@
           ),
           '<a>123</a><option></option>'
         );
-        assert.equal(
+        assert.contains(
           DOMPurify.sanitize(
             '<option><style></option></select><b><img src=xx: onerror=alert(1)></style></option>'
           ),
-          '<option></option>'
+          ['<option></option>', '']
         );
-        assert.equal(
+        assert.contains(
           DOMPurify.sanitize(
             '<option><iframe></select><b><script>alert(1)</script>'
           ),
-          '<option></option>'
+          ['<option></option>', '']
         );
-        assert.equal(
+        assert.contains(
           DOMPurify.sanitize(
             '<option><iframe></select><b><script>alert(1)</script>'
           ),
-          '<option></option>'
+          ['<option></option>', '']
         );
         assert.equal(
           DOMPurify.sanitize(
@@ -1132,7 +1132,7 @@
     QUnit.test('DOMPurify.removed should be correct', function (assert) {
       var dirty = '<option><iframe></select><b><script>alert(1)</script>';
       DOMPurify.sanitize(dirty);
-      assert.equal(DOMPurify.removed.length, 1);
+      assert.equal(DOMPurify.removed.length, 2);
     });
 
     // Test 8 to check that DOMPurify.removed is correct if tags are clean