Another case of bad markup identified in Issue#549. Closing tags without having opening tags. Test cases also added.

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## Issue #549 fix
+- Fixed allowance of disallowed tags with wrong markup of having closing tag without opening tag as reported on [issue #549](https://github.com/apostrophecms/sanitize-html/issues/549).
+
 ## 2.7.1 (2022-07-20)
 
 - Protocol-relative URLs are properly supported for script tags. Thanks to [paweljq](https://github.com/paweljq).

index.js

@@ -521,6 +521,14 @@ function sanitizeHtml(html, options, _recursing) {
         // Do not crash on bad markup
         return;
       }
+
+      if (frame.tag !== name) {
+        // Another case of bad markup.
+        // Push to stack, so that it will be used in future closing tags.
+        stack.push(frame);
+        return;
+      }
+
       skipText = options.enforceHtmlBoundary ? name === 'html' : false;
       depth--;
       const skip = skipMap[depth];

test/test.js

@@ -116,6 +116,23 @@ describe('sanitizeHtml', function() {
   it('should preserve entities as such', function() {
     assert.equal(sanitizeHtml('<a name="&lt;silly&gt;">&lt;Kapow!&gt;</a>'), '<a name="&lt;silly&gt;">&lt;Kapow!&gt;</a>');
   });
+  it('should dump closing tags which do not have any opening tags.', function() {
+    assert.equal(sanitizeHtml('<b><div/', {
+      allowedTags: [ 'b' ]
+    }), '<b></b>');
+
+    assert.equal(sanitizeHtml('<b><b<<div/', {
+      allowedTags: [ 'b' ]
+    }), '<b></b>');
+  });
+  it('should tolerate not closed p tags', function() {
+    assert.equal(sanitizeHtml('<div><p>inner text 1<p>inner text 2<p>inner text 3</div>'), '<div><p>inner text 1</p><p>inner text 2</p><p>inner text 3</p></div>');
+  });
+  it('should escape not closed p tags, if not in allowedTags array', function() {
+    assert.equal(sanitizeHtml('<div><p>inner text 1<p>inner text 2<p>inner text 3</div>', {
+      allowedTags: [ 'div' ]
+    }), '<div>inner text 1inner text 2inner text 3</div>');
+  });
   it('should dump comments', function() {
     assert.equal(sanitizeHtml('<p><!-- Blah blah -->Whee</p>'), '<p>Whee</p>');
   });