漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Vulnerability Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
CVSS Information
N/A
Vulnerability Type
宽松定义的白名单
Vulnerability Title
DOMPurify 跨站脚本漏洞
Vulnerability Description
DOMPurify是Cure53个人开发者的一款使用JavaScript编写的，用于HTML、MathML和SVG的DOM（文档对象模型）。 DOMPurify 3.4.0之前版本存在跨站脚本漏洞，该漏洞源于FORBID_TAGS和FORBID_ATTR处理不一致，导致禁止元素及其属性通过清理。
CVSS Information
N/A
Vulnerability Type
N/A