Cure53 🏳️‍🌈

DOMPurify 3.3.0 will soon be released, with this likely being the most important change in a long time:

GitHub

Allow ADD_ATTR and ADD_TAGS to accept a function by nelstrom · Pull Request #1150 · cure53/DOMPurify

Summary This PR addresses issue #1149 by allowing ADD_ATTR to accept a function for tag-specific attribute validation. Background & Context Cur...

DOMPurify 3.2.7 has been released today, adding several fixes and improvements.

GitHub

Release DOMPurify 3.2.7 · cure53/DOMPurify

Added new attributes and elements to default allow-list, thanks @elrion018 Added tagName parameter to custom element attributeNameCheck, thanks @ne...

Thanks to all folks who contributed 💕

Small change to HTML with massive impact on eliminating mXSS attacks

GitHub

Escape "<" and ">" when serializing attribute values · whatwg/html@e21bd3b

Avoid a class of XSS attacks where markup goes through a lossy parse-serialize-parse roundtrip and the original attribute value is parsed in the da...

DOMPurify 3.2.6 has been release with several smaller fixes and improvements, thanks to all who contributed 💕

GitHub

Release DOMPurify 3.2.6 · cure53/DOMPurify

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellche...

Hopefully this will also help with the CI/CD issues that arose after the fake CVE was posted last week.