Added math to namespaces to look out for

cure53 · Oct 14, 2019 · a63c1cb · a63c1cb
1 parent 884e248
commit a63c1cb
Show file tree

Hide file tree

Showing 9 changed files with 9 additions and 9 deletions.
diff --git a/dist/purify.cjs.js b/dist/purify.cjs.js
diff --git a/dist/purify.cjs.js.map b/dist/purify.cjs.js.map
diff --git a/dist/purify.es.js b/dist/purify.es.js
diff --git a/dist/purify.es.js.map b/dist/purify.es.js.map
diff --git a/dist/purify.js b/dist/purify.js
diff --git a/dist/purify.js.map b/dist/purify.js.map
diff --git a/dist/purify.min.js b/dist/purify.min.js
diff --git a/dist/purify.min.js.map b/dist/purify.min.js.map
diff --git a/src/purify.js b/src/purify.js
@@ -901,7 +901,7 @@ function createDOMPurify(window = getGlobal()) {
 
       /* Take care of an mXSS pattern using namespace switches */
       if (
-        /svg/.test(currentNode.namespaceURI) &&
+        /svg|math/i.test(currentNode.namespaceURI) &&
         new RegExp('</(' + Object.keys(FORBID_CONTENTS).join('|') + ')').test(
           value
         )