{"record":{"id":"9d553b423a044830","repo":"basecamp/trix","slug":"root-node-is-forbidden-and-cannot-be-sanitized-in","errorCode":null,"errorMessage":"root node is forbidden and cannot be sanitized in-place","messagePattern":"root node is forbidden and cannot be sanitized in-place","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"action_text-trix/app/assets/javascripts/trix.js","lineNumber":4019,"sourceCode":" if (inPlace) {\n /* Declarative-partial-updates / streaming pre-pass: sever every patch\n linkage across the live tree BEFORE the walk, so no patch can fire\n mid-walk and inject into an already-processed region. Runs first, so\n it also covers the forbidden/clobbered roots that throw below. */\n _neutralizePatchLinkage(dirty);\n /* Do some early pre-sanitization to avoid unsafe root nodes.\n Read nodeName through the cached prototype getter — a clobbering\n child named \"nodeName\" on the form root would otherwise shadow\n the property and let this check skip the root-allowlist\n validation entirely. */\n const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;\n if (typeof nn === 'string') {\n const tagName = transformCaseFunc(nn);\n if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {\n /* Fail closed on a live root: neutralize handlers/children before\n throwing, exactly as the mid-walk abort path does. */\n _neutralizeRoot(dirty);\n throw typeErrorCreate('root node is forbidden and cannot be sanitized in-place');\n }\n }\n /* Pre-flight the root through _isClobbered. The iterator-driven\n removal path can not detach a parent-less root: _forceRemove\n falls through to Element.prototype.remove(), which per spec\n is a no-op on a node with no parent. A clobbered root would\n then survive the main loop with its attributes uninspected,\n because _sanitizeAttributes early-returns on _isClobbered. The\n result would be an attacker-controlled form, complete with any\n event-handler attributes the caller passed in, handed back to\n the application unsanitized. Refuse to sanitize such a root\n the same way we refuse a forbidden tag. GHSA-r47g-fvhr-h676. */\n if (_isClobbered(dirty)) {\n /* Fail closed on a live clobbered root before throwing.\n _neutralizeRoot's reads are clobber-safe (cached getters); the\n form's non-clobbered descendants, e.g. an armed ![]()
, are scrubbed. */\n _neutralizeRoot(dirty);\n throw typeErrorCreate('root node is clobbered and cannot be sanitized in-place');","sourceCodeStart":4001,"sourceCodeEnd":4037,"githubUrl":"https://github.com/basecamp/trix/blob/470040131122bd44e269b4de0f2e9557f90ec994/action_text-trix/app/assets/javascripts/trix.js#L4001-L4037","documentation":"In in-place sanitization (sanitizing a live DOM root), DOMPurify pre-flights the root node itself: if the root's tagName is not in ALLOWED_TAGS (or is in FORBID_TAGS), the entire root is forbidden. Because the caller requested in-place sanitization, DOMPurify cannot substitute a safe replacement, so it first neutralizes the root (_neutralizeRoot: scrubbing handlers/children fail-closed) and then throws this TypeError instead of returning the unsafe tree.","triggerScenarios":"DOMPurify.sanitize(rootElement, { IN_PLACE: true, ... }) where the root element's tag is disallowed by the current tag allowlist/forbidlist — e.g. sanitizing a