HexBrain

Nextcloud · Report #225777

DOMPurify 0.8.9 released

Validstatus
lowseverity
6upvotes
1 Mar 2020disclosed

How it was found

Got the following via the DOMPurify-Security mailing list:

*Intro*

A new version of DOMPurify was released today: DOMPurify 0.8.9

*Background*

DOMPurify showed weaknesses when handling both the recent Safari
DOMParser XSS and a Firefox mXSS when working with document.write().

Caused by a broken logical check, not all browser bugs were being worked
around correctly.

*Fix*

DOMPurify now performs better checks to mitigate both the Safari
DOMParser XSS and a Firefox mXSS when using document.write().

*Packages*

Updated packages are available here:
https://github.com/cure53/DOMPurify/releases/tag/0.8.9

EOF

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original