DOM Purify - untrusted Node bypass
Introduction In this article, I aim to elucidate a deficiency in the implementation of DOMPurify that I recently uncovered. While it may not pertain to the most common use cases of this library, I found it to be a compelling discovery worthy of exploration.
Purify strings nodes In most scenarios, when utilizing the library, a string is passed to the sanitize function:
DOMPurify.sanitize("slonser") // output:…