Skip to content

0.8.6
Compare
Choose a tag to compare
@cure53 cure53 released this 21 Apr 13:56
0.8.6
b317725
This commit was signed with the committer’s verified signature.
cure53 Cure53
GPG key ID: 5F0CDACD24BB6BF4
Verified
Learn about vigilant mode.
  • Fixed an XSS in Safari 10.1 and 10.2 introduced by a Safari browser bug
    • On Safari 10.1 and 10.2, this now actually causes XSS. Good job, Safari. Not.
    • new DOMParser().parseFromString('<svg onload=alert(document.domain)>', 'text/html');
  • Fixed a minor return value problem on MSIE11 (see #198)
  • Added new flag FORCE_BODY to enable better handling of HTML starting with style and other elements a browser might move into the header (see #199)
  • Added white-listing for ARIA attributes (see #203)
  • Fixed a minor bug in the URI white-list regex (see #200)
  • Fixed a bug where data URI attributes would be removed from SVG content (see #205)
Assets 2
Loading