#195 Possibly XSS vulnerability

[ulikhan]

Hi,

There is a potential XSS vulnerability in the library related to node attributes.

Example HTML:
hello

After DOM manipulation:
hello

Expected output:
hello

PHP code for verification:

hello'; $dom = str_get_html($html); $a = $dom->find('a', 0); $a->setAttribute('title', 'hello onclick=alert(1)'); echo $dom->save(); ?>

[ulikhan]

Sorry, the editor modified my input, please check the attached file.

[LogMANOriginal]

Thanks for reporting this issue. While I agree that this is a bug in the attribute handler, it is not a XSS vulnerability, at least not for this project.

This issue is fixed in [a706de9bcb3b74ad10e04cc0b2de0d1b35007ab4]