Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2.x #1032

Closed
wants to merge 48 commits into from
Closed

2.x #1032

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
48 commits
Select commit Hold shift + click to select a range
5f766bc
See #761
cure53 Feb 7, 2023
08e9fab
test: Added 2.x tag to 2.x branch actions
cure53 Feb 7, 2023
f5c25ac
see #767
cure53 Feb 13, 2023
fa4e8ee
chore: preparing 2.4.4 release
cure53 Feb 13, 2023
f464d95
chore: preparing 2.4.5 release
cure53 Feb 26, 2023
a01c083
Fix: addressed a bypass on jsdom 22 when noframes tag is allowed
cure53 Jun 29, 2023
5b7dff9
chore: Preparing 2.4.6 release
cure53 Jun 29, 2023
ef731c0
chore: Preparing 2.4.7. release
cure53 Jul 11, 2023
f0e75b0
fix: cherry-picked fixes for XML & CE bypass
cure53 Mar 4, 2024
4035e3a
chore: Preparing 2.4.8. release
cure53 Mar 19, 2024
416ba67
chore: Preparing 2.4.8 release
cure53 Mar 19, 2024
0940755
fix: Merged relevant changes from main for 2.4.9
cure53 Mar 21, 2024
79cfb37
chore: Preparing 2.4.9 release
cure53 Mar 21, 2024
28381af
feature: Added SAFE_FOR_XML flag and code to 2.x branch
cure53 Apr 6, 2024
2dcadf0
chore: Preparing 2.5.0 release
cure53 Apr 6, 2024
6f9902d
docs: Updated year in LICENSE file for 2.x as well
cure53 Apr 7, 2024
7f6cf8a
chore: Updated some packages
cure53 Apr 7, 2024
0ef5e53
chore: Updated 2.x branch with relevant fixes for nesting-based mXSS
cure53 Apr 25, 2024
2076d1b
test: Fixed a linter issue breaking the tests
cure53 Apr 25, 2024
8589191
fix: Started to set new MAX_NESTING_DEPTH limits as well
cure53 Apr 26, 2024
381bc61
test: Fixed the tests for new MAX_NESTING_DEPTH limit
cure53 Apr 26, 2024
f275c0b
chore: Preparing 2.5.1 release
cure53 Apr 26, 2024
fc9f702
chore: Migrated relevant changes from main over to 2.x
cure53 Apr 30, 2024
d299fcc
chore: Preparing 2.5.2 release
cure53 Apr 30, 2024
b81a576
chore: Getting 2.x branch up to date with main
cure53 May 5, 2024
76a19d1
fix: Added better configurability for new comment behavior
cure53 May 7, 2024
2e0d6d9
chore: Getting 2.x branch up to date with main
cure53 May 10, 2024
481ff8e
chore: chore: Preparing 2.5.3 release
cure53 May 11, 2024
b45d789
docs: Updated README.md with right version number
cure53 May 11, 2024
26e1d69
fix: Merged prototype pollution check into 2.x
cure53 May 11, 2024
e1ddfc7
Merge branch '2.x' of github.com:cure53/DOMPurify into 2.x
cure53 May 11, 2024
f3a9710
fix: Fixed an issue with MSIE and no support for Number.isNaN
cure53 May 18, 2024
62fe3be
test: Attempting to get MSIE 11 back into the browser test array
cure53 May 18, 2024
707b3d6
fix: Added a better for for the MSIE iNaN issue
cure53 May 18, 2024
b188787
chore: Preparing 2.5.4 release
cure53 May 18, 2024
2c9bca9
test: Changed github config to include MSIE tests for 2.x
cure53 May 18, 2024
2c6410a
test: Fixed several new tests for MSIE11 and Edge 18
cure53 May 19, 2024
1401208
test: Fixed more tests for MSIE and Edge 18
cure53 May 19, 2024
1c92880
test: Fixed two more tests for MSIE11 and Edge 18
cure53 May 19, 2024
10c1261
docs: Updated README ever so slightly
cure53 May 19, 2024
f1e27e6
chore: Also removed depth counter logic from 2.x branch for now
cure53 May 27, 2024
de2545c
chore: Preparing 2.5.5 release
cure53 May 31, 2024
9a7cd98
See #961
cure53 Jun 10, 2024
38e8410
fix: Added changes to 2.x regarding attribute value checks
cure53 Jun 25, 2024
d78f241
chore: Preparing 2.5.6 release
cure53 Jul 5, 2024
71683cb
chore: Preparing 2.5.7 release
cure53 Sep 26, 2024
1bb377b
Update README.md
cure53 Nov 15, 2024
f7712e4
Update README.md
cure53 Nov 20, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
chore: Preparing 2.5.1 release
  • Loading branch information
cure53 committed Apr 26, 2024
commit f275c0b719026501f80d383af942bda921cdf300
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

It's also very simple to use and get started with. DOMPurify was [started in February 2014](https://github.com/cure53/DOMPurify/commit/a630922616927373485e0e787ab19e73e3691b2b) and, meanwhile, has reached version 3.0.0.
It's also very simple to use and get started with. DOMPurify was [started in February 2014](https://github.com/cure53/DOMPurify/commit/a630922616927373485e0e787ab19e73e3691b2b) and, meanwhile, has reached version 3.1.1.

DOMPurify is written in JavaScript and works in all modern browsers (Safari (10+), Opera (15+), Internet Explorer (10+), Edge, Firefox and Chrome - as well as almost anything else using Blink or WebKit). It doesn't break on MSIE6 or other legacy browsers. It either uses [a fall-back](#what-about-older-browsers-like-msie8) or simply does nothing.

**Note that DOMPurify v2.5.0 is the latest version supporting MSIE. For important security updates compatible with MSIE, please use the 2.x branch.**
**Note that DOMPurify v2.5.1 is the latest version supporting MSIE. For important security updates compatible with MSIE, please use the 2.x branch.**

Our automated tests cover [19 different browsers](https://github.com/cure53/DOMPurify/blob/main/test/karma.custom-launchers.config.js#L5) right now, more to come. We also cover Node.js v14.x, v16.x, v17.x and v18.x, running DOMPurify on [jsdom](https://github.com/jsdom/jsdom). Older Node versions are known to work as well, but hey... no guarantees.

Expand Down
2 changes: 1 addition & 1 deletion bower.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "DOMPurify",
"version": "2.5.0",
"version": "2.5.1",
"homepage": "https://github.com/cure53/DOMPurify",
"author": "Cure53 <info@cure53.de>",
"description": "A DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG",
Expand Down
4 changes: 2 additions & 2 deletions dist/purify.cjs.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions dist/purify.es.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions dist/purify.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions dist/purify.min.js

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@
},
"name": "dompurify",
"description": "DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else using Blink or WebKit). DOMPurify is written by security people who have vast background in web attacks and XSS. Fear not.",
"version": "2.5.0",
"version": "2.5.1",
"directories": {
"test": "test"
},
Expand Down
4 changes: 2 additions & 2 deletions website/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<html>
<head>
<meta charset="UTF-8">
<title>DOMPurify 2.5.0 "Time Machine"</title>
<title>DOMPurify 2.5.1 "Baldwin Alabama"</title>
<script src="../dist/purify.min.js"></script>
<!-- we don't actually need it - just to demo and test the $(html) sanitation -->
<script src="//code.jquery.com/jquery-3.2.0.min.js"></script>
Expand All @@ -23,7 +23,7 @@
</script>
</head>
<body>
<h4>DOMPurify 2.5.0 "Time Machine"</h4>
<h4>DOMPurify 2.5.1 "Baldwin Alabama"</h4>
<p>
<a href="http://badge.fury.io/js/dompurify" rel="nofollow"><img alt="npm version" src="https://badge.fury.io/js/dompurify.svg"></a>
<a target="_blank" rel="noopener noreferrer" href="https://github.com/cure53/DOMPurify/workflows/Build%20and%20Test/badge.svg?branch=main"><img src="https://github.com/cure53/DOMPurify/workflows/Build%20and%20Test/badge.svg?branch=main" alt="Build and Test"></a>
Expand Down
Loading