From 8cd61826294c86cd706784587794425925154fe6 Mon Sep 17 00:00:00 2001 From: rootvector2 Date: Tue, 2 Jun 2026 01:08:13 +0530 Subject: [PATCH] sanitize javascript: urls in href on area elements --- .../integration-tests/test/attributes-test.ts | 9 +++++++++ packages/@glimmer/runtime/lib/dom/sanitized-values.ts | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/packages/@glimmer-workspace/integration-tests/test/attributes-test.ts b/packages/@glimmer-workspace/integration-tests/test/attributes-test.ts index eef13f25c13..bd9f786a4cd 100644 --- a/packages/@glimmer-workspace/integration-tests/test/attributes-test.ts +++ b/packages/@glimmer-workspace/integration-tests/test/attributes-test.ts @@ -719,3 +719,12 @@ jitSuite( protected isSelfClosing = false; } ); + +jitSuite( + class extends BoundValuesToSpecialAttributeTests { + static suiteName = 'area[href] attribute'; + protected tag = 'area'; + protected attr = 'href'; + protected override isEmptyElement = true; + } +); diff --git a/packages/@glimmer/runtime/lib/dom/sanitized-values.ts b/packages/@glimmer/runtime/lib/dom/sanitized-values.ts index a5203749453..b33ff12f596 100644 --- a/packages/@glimmer/runtime/lib/dom/sanitized-values.ts +++ b/packages/@glimmer/runtime/lib/dom/sanitized-values.ts @@ -4,7 +4,7 @@ import { isSafeString, normalizeStringValue } from '../dom/normalize'; const badProtocols = ['javascript:', 'vbscript:']; -const badTags = ['A', 'BODY', 'LINK', 'IMG', 'IFRAME', 'BASE', 'FORM']; +const badTags = ['A', 'AREA', 'BODY', 'LINK', 'IMG', 'IFRAME', 'BASE', 'FORM']; const badTagsForDataURI = ['EMBED'];