bekk/retire.js — pull request #54 by bkimminich (2014-10-22 22:44:02+00:00)
Title: Added two non-recursive html sanitization issues

The module ```sanitize-html``` up to version 1.4.2 is susceptible to masking attacks in order to trick the sanitization. Root cause lies in ```htmlparser2```up to at least 3.7.3 which does not work recursively until the result stops changing but only runs once. The former module is hotfixed with 1.4.3 while the latter is not fixed as of now.

Examples:
- ```<img src="csrf-attack"/>```sanitizes into ``````
- ```<script>alert("XSS3")</script>```sanitizes into ``````