fix: fix XSS bypass via split `</script` payload across function bodies - #226

Merged

okuryu merged 6 commits into

mainfrom

okuryu-investigate-issue-220-xss

Aug 29, 2026

Commits on Aug 26, 2026

Fix XSS bypass via </script split across function bodies (#220)

okuryu
and
Copilot
committed
c731e6e
Remove backslash from script-close delimiter check

okuryu
and
Copilot
committed
5cdf61b
Make script-close escaping lexically aware to avoid breaking valid JS

okuryu
and
Copilot
committed
0122baf
Fix quadratic scan and regex-literal quote misclassification

okuryu
and
Copilot
committed
e26ddc7
Treat regex bracket character classes as opaque in STRING_OR_COMMENT_REGEXP

okuryu
and
Copilot
committed
72d42f1
Simplify explanatory comments in index.js

okuryu
and
Copilot
committed
1f2ee03