diff --git a/src/transform/sanitize.ts b/src/transform/sanitize.ts index 2574a7dd..20dbf7c1 100644 --- a/src/transform/sanitize.ts +++ b/src/transform/sanitize.ts @@ -560,7 +560,9 @@ function sanitizeStyleTags(dom: cheerio.CheerioAPI, cssWhiteList: CssWhiteList) }); dom(element).text(css.stringify(parsedCSS)); - } catch {} + } catch { + dom(element).remove(); + } }); } diff --git a/test/__snapshots__/xss.test.ts.snap b/test/__snapshots__/xss.test.ts.snap index b957bc8a..4e11697c 100644 --- a/test/__snapshots__/xss.test.ts.snap +++ b/test/__snapshots__/xss.test.ts.snap @@ -284,11 +284,7 @@ exports[` meta 1`] = `""`; exports[` style sheet 1`] = `""`; -exports[` style tag 1`] = ` - -`; +exports[` style tag 1`] = `""`; exports[` style tag using background 1`] = ` + +

+`; diff --git a/test/xss.test.ts b/test/xss.test.ts index 906ee8df..69481e0d 100644 --- a/test/xss.test.ts +++ b/test/xss.test.ts @@ -112,6 +112,10 @@ const ckecks = [ 'style tag using background', ``, ], + [ + 'svg with style tag and foreignObject inside', + '', + ], ['Anonymous HTML with style attribute', ``], ['Local htc file', ``], ['US-ASCII encoding', `¼script¾alert(¢XSS¢)¼/script¾`],