DOMPurify
DOMPurify copied to clipboard
Published
20 hours ago •
cure53
cure53
Chrome: sanitizing `referrer` meta tag still applies the referrer policy
Background & Context
Possibly related to https://github.com/cure53/DOMPurify/issues/409.
Possibly the a consequence of this Chromium bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1092930&q=meta%20referer&can=2
Bug
In Chrome (104), if you pass a meta tag with a strict referrer policy, it removes the meta tag but the policy will still apply (and persist indefinitely)
Steps to reproduce
- From the DOMPurify demo page, run a fetch (in my case https://api.sampleapis.com/beers/ale) from the console
The Refererheader is correctly present on the request. - Run the string
<meta name="referrer" content="never">through the sanitizer and write the result to the DOM. - The cleaned DOM is empty -- the meta tag has been removed.
- Run a fetch from the console. The
Refererheader is now missing:
In our application, this means all subsequent internal network requests fail until a full refresh.
Suggested workaround
Our workaround (like #409) is to manually strip meta tags prior to sanitization.
Interesting :D Thanks for the heads-up. I am not sure if we can do much here - looks like indeed Chrome has to fix this, no?
