From f6893d338b4cff2cd17d6dbe439e13f14592a6e3 Mon Sep 17 00:00:00 2001
From: rugk <rugk+git@posteo.de>
Date: Thu, 13 Nov 2025 13:34:51 +0000
Subject: [PATCH 1/3] refactor: use DOMParser for checking if translation is
 HTML

---
 js/privatebin.js | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/js/privatebin.js b/js/privatebin.js
index 29f2dd44..c02767e2 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -963,13 +963,17 @@ jQuery.PrivateBin = (function($) {
          * @returns {boolean}
          */
         function isStringContainsHtml(messageId) {
-            // An integer which specifies the type of the node. An Element node like <p> or <div>.
-            const elementNodeType = 1;
-
-            const div = document.createElement('div');
-            div.innerHTML = messageId;
-
-            return Array.from(div.childNodes).some(node => node.nodeType === elementNodeType);
+            // Use DOMParser to parse the string as HTML. DOMParser does not
+            // execute scripts nor load external resources when parsing, making
+            // it safer against XSS.
+            try {
+                const doc = new DOMParser().parseFromString(String(messageId), 'text/html');
+                return Array.from(doc.body.childNodes).some(node => node.nodeType === Node.ELEMENT_NODE);
+            } catch (e) {
+                // If parsing fails for any reason, consider it not HTML to avoid
+                // treating arbitrary strings as markup.
+                return false;
+            }
         }
 
         return me;

From ad55131831307920b18f600f5eb5c04d384817cf Mon Sep 17 00:00:00 2001
From: rugk <rugk+git@posteo.de>
Date: Sat, 15 Nov 2025 09:57:39 +0000
Subject: [PATCH 2/3] refactor: use given HTML config for DOMPurify

---
 js/privatebin.js | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/js/privatebin.js b/js/privatebin.js
index c02767e2..f8a55cbe 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -812,12 +812,11 @@ jQuery.PrivateBin = (function($) {
 
             if (containsHtml) {
                 // only allow tags/attributes we actually use in translations
-                output = DOMPurify.sanitize(
-                    output, {
+                const sanitizeConfig = Object.assign({}, purifyHtmlConfig, {
                         ALLOWED_TAGS: ['a', 'i', 'span', 'kbd'],
                         ALLOWED_ATTR: ['href', 'id']
-                    }
-                );
+                });
+                output = DOMPurify.sanitize(output, sanitizeConfig);
             }
 
             // if $element is given, insert translation

From ce06857d2cdd380bfc3cd73410cb1f63d85aae2b Mon Sep 17 00:00:00 2001
From: rugk <rugk+git@posteo.de>
Date: Thu, 27 Nov 2025 21:05:59 +0000
Subject: [PATCH 3/3] chore update SRI hash of main JS file

---
 lib/Configuration.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Configuration.php b/lib/Configuration.php
index 2cccc342..5bee1cab 100644
--- a/lib/Configuration.php
+++ b/lib/Configuration.php
@@ -121,7 +121,7 @@ class Configuration
             'js/kjua-0.10.0.js'      => 'sha512-BYj4xggowR7QD150VLSTRlzH62YPfhpIM+b/1EUEr7RQpdWAGKulxWnOvjFx1FUlba4m6ihpNYuQab51H6XlYg==',
             'js/legacy.js'           => 'sha512-rGXYUpIqbFoHAgBXZ0UlJBdNAIMOC9EQ67MG0X46D5uRB8LvwzgKirbSQRGdYfk8I2jsUcm+tvHXYboUnC6DUg==',
             'js/prettify.js'         => 'sha512-puO0Ogy++IoA2Pb9IjSxV1n4+kQkKXYAEUtVzfZpQepyDPyXk8hokiYDS7ybMogYlyyEIwMLpZqVhCkARQWLMg==',
-            'js/privatebin.js'       => 'sha512-ZwoUDxBdEE+zNoGqr9o7X7CJYS4JStEeNvcOnhz69YVbXjiibNoYSY7i3vc6MLI3M/K1K6sIUmSFm8sjoUdF5Q==',
+            'js/privatebin.js'       => 'sha512-lR/UzD67Pbg9nHDxDHxXktRKbXTQ96bDucbzbc0ELOLGzJHBqv1Qih+Aw+blBlAxXAdjuJDf9ch+R4m+i5bsQg==',
             'js/purify-3.3.0.js'     => 'sha512-lsHD5zxs4lu/NDzaaibe27Vd2t7Cy9JQ3qDHUvDfb4oZvKoWDNEhwUY+4bT3R68cGgpgCYp8U1x2ifeVxqurdQ==',
             'js/showdown-2.1.0.js'   => 'sha512-WYXZgkTR0u/Y9SVIA4nTTOih0kXMEd8RRV6MLFdL6YU8ymhR528NLlYQt1nlJQbYz4EW+ZsS0fx1awhiQJme1Q==',
             'js/zlib-1.3.1-1.js'     => 'sha512-5bU9IIP4PgBrOKLZvGWJD4kgfQrkTz8Z3Iqeu058mbQzW3mCumOU6M3UVbVZU9rrVoVwaW4cZK8U8h5xjF88eQ==',