shadowdaoandClaude Opus 5
6a9b227dda
Review follow-up on the Task 24 sanitiser widening (approved, no bypass found). Two Important findings to close: 1. ALLOWED_URI_REGEXP's data:image/...;base64, arm sat inside the group that appends a trailing `:` to every alternative, so it required a second colon no real data URI has -- the clause could never match. Confirmed dead before the fix (poster/cite/href all stripped a valid base64 PNG data URI) and working after (all three now survive), while javascript:/data:text/html stay blocked. Pulled the arm out into its own top-level alternative. 2. Corrected an inaccurate comment/report claim that every allowed attribute value goes through this regex -- `src` on img/video/audio/source/image/track is additionally covered by DOMPurify's own DATA_URI_TAGS allow-list, which is mimetype-blind and bypasses the regex entirely (acceptable: none of those tags execute src as a document; iframe is correctly excluded from that list). Adds two regression tests: the regex fix actually working, and the DATA_URI_TAGS bypass pinned so a future DOMPurify change surfaces as a failing test rather than a surprise. Fixture byte figures unchanged (15,815 -> 14,899; fixture has no data:image URIs). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
