DOMPurify 1.0.3

• Added support for more attributes (srcset, crossdorigin etc.)
• Fixed overzealous DOM clobbering protection
• Added support for URI regex customization via ALLOWED_URI_REGEXP

DOMPurify 1.0.2

• Made DOMPurify be fully CSP compliant

DOMPurify 1.0.1

Fixed various issues with the node.js loader
Fixed various issues with the test-suite

DOMPurify 1.0.0

• Refactored DOMPurify to ES2016/ES2017
• Fixed an exception on iOS Safari
• Fixed a JSDOM related bug on node.js
• Fixed numerous minor issues
• Added markup profiles feature

DOMPurify 0.9.0

• Fixed and worked around newly discovered variations of the Safari 10.1 - 10.2 XSS
• Fixed unsafe document generation for Safari 10.1 and 10.2
• Added feature test to spot additionally broken versions if necessary
• Added a configuration flag to use persistent configuration

DOMPurify 0.8.9

• Fixed another aspect of the Safari XSS
• Added better checks for old Firefox mXSS

DOMPurify 0.8.7

• Cleaned up after Safari emergency fix
• General code and comment clean-up
• Added test for Firefox mXSS issue
• Added more browsers to the test array

Big thanks go to Egor Karbutov @ShikariSenpai and Egor Saltykov @ansjdnakjdnajkd for spotting and reporting the Safari issue to FastMail!

0.8.6

• Fixed an XSS in Safari 10.1 and 10.2 introduced by a Safari browser bug
  • On Safari 10.1 and 10.2, this now actually causes XSS. Good job, Safari. Not.
  • new DOMParser().parseFromString('<svg onload=alert(document.domain)>', 'text/html');
• Fixed a minor return value problem on MSIE11 (see #198)
• Added new flag FORCE_BODY to enable better handling of HTML starting with style and other elements a browser might move into the header (see #199)
• Added white-listing for ARIA attributes (see #203)
• Fixed a minor bug in the URI white-list regex (see #200)
• Fixed a bug where data URI attributes would be removed from SVG content (see #205)

DOMPurify 0.8.5

• Allowed users to pass DOM nodes for sanitization
• Fixed a small problem with empty DOM fragments on MSIE11
• Fixed removal of data: URIs in img-src when having whitespaces
• Added more test coverage

DOMPurify 0.8.4

• Made the uponSanitizeElement and uponSanitizeAttribute hooks more powerful (see #184)
• Updated MentalJS sandbox in the demo folder