fix: Added better check for animated href attributes, thanks @llamakko

Author: cure53

dist/purify.cjs.js

@@ -1079,6 +1079,11 @@ function createDOMPurify() {
         _removeAttribute(name, currentNode);
         continue;
       }
+      /* Make sure we cannot easily use animated hrefs, even if animations are allowed */
+      if (lcName === 'attributename' && stringMatch(value, 'href')) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
       /* Did the hooks approve of the attribute? */
       if (hookEvent.forceKeepAttr) {
         continue;

dist/purify.cjs.js.map

@@ -1325,6 +1325,12 @@ function createDOMPurify(window: WindowLike = getGlobal()): DOMPurify {
         continue;
       }
 
+      /* Make sure we cannot easily use animated hrefs, even if animations are allowed */
+      if (lcName === 'attributename' && stringMatch(value, 'href')) {
+        _removeAttribute(name, currentNode);
+        continue;
+      }
+
       /* Did the hooks approve of the attribute? */
       if (hookEvent.forceKeepAttr) {
         continue;