fix: Strip Every Tag From the Text of Kept Literal-Content Elements

[jmanico]

Summary

Found while working on #463 and reported to the maintainer, who asked for a public PR.

The filter that the CVE-2025-66021 fix (d6e0463) put on the text of a kept style or script element re-emitted the start tag of any element the policy allowed, attributes and all, with no attribute policy run over it, and kept an end tag whenever its element was allowed. A browser with scripting on reads noscript as raw text up to the first </noscript> and parses what follows as markup, so under a policy allowing noscript, style with text and img:

<noscript><style></noscript><img src=x onerror=alert(1)></style></noscript>

came out unchanged and runs the handler. The normal path strips onerror. noframes and noembed break out the same way regardless of scripting, and iframe content is literal to the renderer too but never reached the filter, which looked only for style and script.

The IE-only comment element was a separate hole: the sanitizer read its content as raw text and emitted it unescaped, while every current browser parses that content as markup, so a tag inside it reached the browser unvetted with no breakout needed. A reviewer also showed that, with the filter in place, a start tag with no > of its own inside comment text was completed by the > of the sanitizer's own </comment>. The element is no longer classified as literal content at all: its content is lexed as markup, vetted by the policy and escaped by the renderer, like any unknown element's.

• The filter now removes every tag from the text of any element whose content the renderer emits unescaped, end tags first of all, judged by the escaping mode of the name the renderer will use. xmp, listing and plaintext become pre and are escaped, so they are not affected.
• A start tag still goes with its content through a matching end tag in the same chunk, so <script>alert(1)</script> inside a style block goes entirely, but a start tag with no matching end tag now goes alone instead of taking the rest of the chunk with it, and a < that opens no tag stays, except where a following chunk could complete it into an end tag. That also fixes the pre-existing loss of if (a < b) in kept script text.
• Text arrives in chunks with boundaries anywhere, so each chunk is made safe on its own; a test delivers the content one character at a time through a preprocessor.
• Tests Deeply nested elements crash FF 8, Chrome 11 #3, NUL byte in input will cause output to be blank. #4 and HtmlPolicyBuilder.allowUrlProtocols() doesn't work #5 from the original fix pinned the re-emitted div and the kept </noscript> and </p>; their expectations now show those gone, with the reason in each javadoc.

Test plan

• New tests in HtmlSanitizerTest: the img and b handler payloads through noscript, the same through noframes and noembed with every end tag spelling a browser accepts, iframe content, the comment element with a complete and with an unterminated start tag inside it, the one-character-chunk case, a chunk of 200,000 unmatched tags staying linear, and the fidelity cases for a bare <, an unmatched start tag and a matched one.
• All existing tests pass, with the three expectation changes above.
• ./mvnw clean verify passes on JDK 11, 17, 21 and 25.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VYF1WjZmwbGNrph7RDw2BS

[github-actions]

🎉 This issue has been resolved in release-20260921.1 (Release Notes)