[XSS] Ignore case of blacklisted HTML elements (#247)

* Ignore case of blacklisted HTML elements * Only use lowercased tagname if blacklisted element
quantizor · May 29, 2019 · dab7b5d · dab7b5d
1 parent 9570018
commit dab7b5d
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/index.compiler.spec.js b/index.compiler.spec.js
@@ -2389,6 +2389,18 @@ $25
   new Date();
 </script>
 
+`);
+  });
+
+  it('does not parse the inside of <script> blocks with weird capitalization', () => {
+    render(compiler(['<SCRIPT>', '  new Date();', '</SCRIPT>'].join('\n')));
+
+    expect(root.innerHTML).toMatchInlineSnapshot(`
+
+<script data-reactroot>
+  new Date();
+</script>
+
 `);
   });
 

diff --git a/index.js b/index.js
@@ -1025,8 +1025,9 @@ export function compiler(markdown, options) {
           ? parseBlock
           : parseInline;
 
+        const tagName = capture[1].toLowerCase();
         const noInnerParse =
-          DO_NOT_PROCESS_HTML_ELEMENTS.indexOf(capture[1]) !== -1;
+          DO_NOT_PROCESS_HTML_ELEMENTS.indexOf(tagName) !== -1;
 
         return {
           attrs: attrStringToMap(capture[2]),
@@ -1038,7 +1039,7 @@ export function compiler(markdown, options) {
 
           noInnerParse,
 
-          tag: capture[1],
+          tag: noInnerParse ? tagName : capture[1]
         };
       },
       react(node, output, state) {