fix: re-enabled the mXSS check for old Chrome at the right place

Author: cure53

dist/purify.cjs.js

@@ -643,6 +643,15 @@ function createDOMPurify(window = getGlobal()) {
       allowedTags: ALLOWED_TAGS,
     });
 
+    /* Take care of an mXSS pattern using p, br inside svg, math */
+    if (
+      (tagName === 'svg' || tagName === 'math') &&
+      currentNode.querySelectorAll('p, br').length !== 0
+    ) {
+      _forceRemove(currentNode);
+      return true;
+    }
+
     /* Detect mXSS attempts abusing namespace confusion */
     if (
       !_isNode(currentNode.firstElementChild) &&
@@ -840,15 +849,6 @@ function createDOMPurify(window = getGlobal()) {
         continue;
       }
 
-      /* Take care of an mXSS pattern using namespace switches */
-      if (
-        regExpTest(/svg|math/i, currentNode.namespaceURI) &&
-        regExpTest(/<\//, value)
-      ) {
-        _removeAttribute(name, currentNode);
-        continue;
-      }
-
       /* Sanitize attribute content to be template-safe */
       if (SAFE_FOR_TEMPLATES) {
         value = stringReplace(value, MUSTACHE_EXPR, ' ');