vulnerability found in auto double quoting feature.

[adon-at-work]

<img src="x" id='" onerror="alert(1)' /> it's not vulnerable itself. but after purification, it becomes <img src="x" id="" onerror="alert(1)" /> this boils down to the problem of always using double quote in html purifier since v1.0 https://github.com/yahoo/html-purify/blob/v1.0.0/src/html-purify.js#L66

reported here as recommended by @yukinying

[yukinying]

cc @maditya

[yukinying]

Root cause of such should be in https://github.com/yahoo/html-purify/blob/master/src/html-purify.js#L120

[adon-at-work]

plus https://github.com/yahoo/html-purify/blob/master/src/html-purify.js#L113

[ramijarrar]

Was this released in 1.1?

[maditya]

We have an open PR for this - https://github.com/yahoo/html-purify/pull/22 and will merge it soon.