fix: Added better configurability for new comment behavior

cure53 · May 7, 2024 · b6818ce · b6818ce
1 parent aafd7a8
commit b6818ce
Show file tree

Hide file tree

Showing 9 changed files with 13 additions and 13 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.mjs b/dist/purify.es.mjs
@@ -1205,8 +1205,8 @@ function createDOMPurify() {
         continue;
       }
 
-      /* Work around a security issue with comments inside attribites */
-      if (regExpTest(/(--!?|])>/i, value)) {
+      /* Work around a security issue with comments inside attributes */
+      if (SAFE_FOR_XML && regExpTest(/(--!?|])>/i, value)) {
         _removeAttribute(name, currentNode);
         continue;
       }

diff --git a/dist/purify.es.mjs.map b/dist/purify.es.mjs.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -1311,8 +1311,8 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
-      /* Work around a security issue with comments inside attribites */
-      if (regExpTest(/(--!?|])>/i, value)) {
+      /* Work around a security issue with comments inside attributes */
+      if (SAFE_FOR_XML && regExpTest(/(--!?|])>/i, value)) {
         _removeAttribute(name, currentNode);
         continue;
       }