[Security] Bump dompurify from 2.0.10 to 2.3.0

[dependabot-preview]

Bumps dompurify from 2.0.10 to 2.3.0. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Cross-site Scripting in dompurify Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Affected versions: < 2.0.17

Release notes

Sourced from dompurify's releases.

DOMPurify 2.3.0

• Added better handling of document creation on Firefox
• Added better handling of version numbers in license file
• Added two new browser versions to test suite config
• Fixed a bug with handling of custom data attributes

DOMPurify 2.2.9

• Fixed some minor issues related to the NAMESPACE config
• Fixed some minor issues relating to empty input
• Fixed some minor issues relating to handling of invalid XML

DOMPurify 2.2.8

• Added NAMESPACE config option, thanks @​NateScarlet
• Added better fallback for older browsers & PhantomJS, thanks @​albanx
• Extended allow-list for SVG attributes a bit

DOMPurify 2.2.7

• Fixed handling of unsupported browsers, i.e. Safari 9 and older
• Fixed various minor bugs and typos in README and examples
• Added better handling of potentially harmful "is" attributes
• Added better handling of lookupGetter functionality

DOMPurify 2.2.6

• Added new mXSS prevention logic created by SecurityMB

DOMPurify 2.2.4

• Fixed a new MathML-based bypass submitted by PewGrand
• Fixed a new SVG-related bypass submitted by SecurityMB
• Updated NodeJS CI to Node 14.x and Node 15.x
• Cleaned up _forceRemove logic for better reliability

DOMPurify 2.2.3

• Fixed an mXSS issue reported by PewGrand
• Fixed a minor issue with the license header
• Fixed a problem with overly-eager CSS stripping
• Updated the README and removed an XSS warning

DOMPurify 2.2.2

• Fixed an mXSS bypass dropped on us publicly via #482
• Fixed an mXSS variation that was reported privately short after
• Added dialog to permitted elements list
• Fixed a small typo in the README

DOMPurify 2.2.0

• Fix a possible XSS in Chrome that is hidden behind #enable-experimental-web-platform-features, reported by @​neilj and @​mfreed7
• Changed RETURN_DOM_IMPORT default to true to address said possible XSS
• Updated README to reflect the new change and inform about the risks of manually setting RETURN_DOM_IMPORT back to false
• Fixed the tests to properly address the new default

... (truncated)

Commits

• e15ae1e chore: Preparing 2.3.0 release
• dd63379 fix: fixed return value for jsdom
• 85382c7 fix: changed return type for document depending on namespace
• 9f202e3 fix: changed an element getter causing trouble on FF
• 99e602a test: fixed FF browser version
• 34ed70d test: added Chrome 90 and FF 90 to tested browsers
• 6b550f3 See #548
• 05aefb4 See #548
• 16d8eed See #483
• 9de5b19 chore: Preparing 2.2.9 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)