Preserve text gates in renamed literal-content elements
Aligned the sanitizer policy stack with the renderer when an element policy renames a container into literal content, ensuring nested text remains governed by the renamed element's text gate.
OWASP/java-html-sanitizer · #489
Sanitizer policy-correctness fix
Nested elements can no longer override the text policy of an element renamed into literal content such as `style`.
Problem
When a custom policy renamed an element to `style`, a nested allowed tag could become the policy's active text container even though the renderer discarded that tag. Its text could then pass through despite text not being allowed in the outer renamed element.
Approach
Tracks whether a kept literal-content element is open separately from whether its text is allowed. Nested start tags are treated as dropped before they can establish another text gate, and the prior state is restored when the literal-content element closes.
Impact and scope
- Makes custom element-renaming policies honor their declared text restrictions consistently.
- Keeps the policy's open-element state aligned with what the renderer can actually emit inside literal content.
- Preserves explicitly allowed text and following siblings while reporting nested tags as discarded.
Validation
- Added negative and positive regressions for denied and explicitly allowed text, plus coverage for following siblings and change reporting.
- The complete Maven verification passed on JDK 25: 604 library tests and seven example tests.
- An OWASP maintainer merged the authored PR and closed GH-482 through a GitHub-verified merge commit. The issue characterizes the path as a custom policy-author mistake, not a general sanitizer bypass.