Severity: 🟢 Low (defense-in-depth; weak denylist)
Location
src/security/constants.ts:132-169 (RESERVED_IDS), applied at src/security/sanitize-core.ts:286.
Description
DOM-clobbering protection only strips id/name values whose exact (trimmed, lowercased) value is in a ~30-entry reserved list. Generic clobbering passes: <a id="myCustomGlobal"> and the classic <a id=x></a><a id=x name=y></a> HTMLCollection-clobbering vector survive unchanged. The list is also incomplete (attributes, nodeName, getElementById, defaultView, implementation, … are absent). Any app that reads window.<id>, document.<name>, or uses named form controls remains clobberable.
Suggested fix
Treat this as defense-in-depth and document it as such. Consider optionally namespacing/prefixing untrusted id/name, or dropping them entirely on untrusted content; at minimum expand the list and reject duplicate ids within a sanitized fragment.
Filed as part of a full-codebase security & correctness audit.
Severity: 🟢 Low (defense-in-depth; weak denylist)
Location
src/security/constants.ts:132-169(RESERVED_IDS), applied atsrc/security/sanitize-core.ts:286.Description
DOM-clobbering protection only strips
id/namevalues whose exact (trimmed, lowercased) value is in a ~30-entry reserved list. Generic clobbering passes:<a id="myCustomGlobal">and the classic<a id=x></a><a id=x name=y></a>HTMLCollection-clobbering vector survive unchanged. The list is also incomplete (attributes,nodeName,getElementById,defaultView,implementation, … are absent). Any app that readswindow.<id>,document.<name>, or uses named form controls remains clobberable.Suggested fix
Treat this as defense-in-depth and document it as such. Consider optionally namespacing/prefixing untrusted
id/name, or dropping them entirely on untrusted content; at minimum expand the list and reject duplicate ids within a sanitized fragment.Filed as part of a full-codebase security & correctness audit.