Описание
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Summary
In src/purify.ts:1117-1123, ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) bypasses FORBID_TAGS due to short-circuit evaluation.
The condition:
When tagCheck(tagName) returns true, the entire condition is false and the element is kept — FORBID_TAGS[tagName] is never evaluated.
Inconsistency
This contradicts the attribute-side pattern at line 1214 where FORBID_ATTR explicitly wins first:
For tags, FORBID should also take precedence over ADD.
Impact
Applications using both ADD_TAGS as a function and FORBID_TAGS simultaneously get unexpected behavior — forbidden tags are allowed through. Config-dependent but a genuine logic inconsistency.
Suggested Fix
Check FORBID_TAGS before tagCheck:
Affected Version
v3.3.3 (commit 883ac15)
Пакеты
dompurify
<= 3.3.3
3.4.0
Связанные уязвимости
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
A flaw was found in DOMPurify. A logic error in the ADD_TAGS function allows an attacker to bypass security restrictions. By crafting specific input, an attacker can cause tags that should be removed to remain in the sanitized output. This could lead to the injection of malicious content, potentially compromising the integrity of web pages.
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function ...