Empty string on webOS 1.2/2.0 (WebKit)

[dmitrylyzo]

Background & Context

We use DOMPurify 2.3.4 and need to support webOS 1.2/2.0
They use some older WebKit engines that do not seem to support the text/html type in DOMParser (returns null).
Then DOMPurify goes to the createDocument workaround.
It creates a document with documentElement = 'template'.
In the last step it looks for body, but it is not there (neither is html) - the root is template.

This can be reproduced in Chrome:

const doc = document.implementation.createDocument('http://www.w3.org/1999/xhtml', 'template', null);
doc.documentElement.innerHTML = '<center>test</center>';
console.debug(doc.documentElement.getElementsByTagName('body')); // -> HTMLCollection []

It probably need to look for template if that workaround was used, or just skip this section.

DOMPurify/src/purify.js

Lines 796 to 802 in 9172631

	/* Work on whole document or just its body */
	if (NAMESPACE === HTML_NAMESPACE) {
	return getElementsByTagName.call(
	doc,
	WHOLE_DOCUMENT ? 'html' : 'body'
	)[0];
	}

Bug

Input

'<center>test</center>'

Given output

'' (empty string)

Expected output

'<center>test</center>'

[dmitrylyzo]

Tried to skip that block.
The center element doesn't pass the _checkValidNamespace checks.
The node has no namespaceURI property.

The createHTMLDocument('') workaround works.

[cure53]

Heya, hmmm, what are we supposed to do now? :)

[dmitrylyzo]

Well, I got it work with the current implementation: {PARSER_MEDIA_TYPE: 'application/xhtml+xml'}.

But in order for it not to fail with text/html by default, a possible solution:

    if (NAMESPACE === HTML_NAMESPACE) {
      try {
        doc = new DOMParser().parseFromString(dirtyPayload, PARSER_MEDIA_TYPE);

        /* >>>>>>>>>> */
        /* Use createHTMLDocument in case DOMParser doesn't support 'text/html' (WebKit) */
        if (!doc && PARSER_MEDIA_TYPE === 'text/html') {
            doc = implementation.createHTMLDocument('');
            doc.documentElement.innerHTML = dirtyPayload;
        }
       /* <<<<<<<<<< */
       } catch (_) {}
   }

The createHTMLDocument fallback has been removed in #534

[cure53]

Aye, thanks! Given it's an issue in non-supported browsers for a non-standard element and you managed to solve it, I would propose to leave things as they are. Any objections?

[dmitrylyzo]

Remarks about {PARSER_MEDIA_TYPE: 'application/xhtml+xml'} workaround:

• It adds xmlns="http://www.w3.org/1999/xhtml" to almost every tag.
• HTML<br>"test became HTML<br></br>. It probably doesn't like unescaped quotes.
  With createHTMLDocument and if DOMParser supports text/html, it remains HTML<br>"test.

I also tried to modify the unit-test to emulate the lack of text/html support and added createHTMLDocument from the above - it fails 3 SVG tests, returning clean but shorten results.