Issue rendering CSS with

Question

DOMPurify is integrated within the ModSecurity WAF XSS Evasion Demo here -

cure53 · Answer

This will be implicitly fixed by two new options that are currently in testing phase:<

rcbarnett-zz · Answer

I am directly linking the raw purify.js file from GitHub in the page. I am guessing I

cure53 · Answer

Not necessarily, you can use a config object to pass in your own settings:

rcbarnett-zz · Answer

I added that config var to my wrapper file here -

rcbarnett-zz · Answer

I created a workaround by moving the CSS call before the >plaintext TAG so that it

cure53 · Answer

is not allowed, causes XSS on Chrome Can

rcbarnett-zz · Answer

Understood - but in my Demo setup, having that CSS link in execute prior to DOMPurify

cure53 · Answer

Yup

ohpe · Answer

If WHOLE_DOCUMENT is set to

Issue rendering CSS with <style> being the first element about dompurify HOT 9 CLOSED