Skip to main content

Operator Precedence Logic Error in dompurify

Cx9cf6447f-1ecc

  • dompurify
  • org.webjars.npm:dompurify
Medium
5.3/10

Summary

In `src/purify.ts:1117-1123`, `ADD_TAGS` as a function (via `EXTRA_ELEMENT_HANDLING.tagCheck`) bypasses `FORBID_TAGS` due to short-circuit evaluation. Affected versions are prior to 3.4.0.

  • LOW
  • NETWORK
  • PASSIVE
  • NONE

CWE-783 - Operator Precedence Logic Error

The program uses an expression in which operator precedence causes incorrect logic to be used.

References

Advisory Timeline

  • Published