@@ -71,6 +71,16 @@ public static function dataProviderForTestWithDefaultSettings(): iterable
7171 yield ['<script> ' , '<script> ' ];
7272 yield ['<plaintext> ' , '<plaintext> ' ];
7373
74+ // Newline/whitespace bypass attempts (security fix)
75+ yield ["<script > " , "<script > " ];
76+ yield ["<script \n> " , "<script \n> " ];
77+ yield ["<script \t> " , "<script \t> " ];
78+ yield ["<script \r\n> " , "<script \r\n> " ];
79+ yield ["<iframe \nwidth= \"560 \"> " , "<iframe \nwidth= \"560 \"> " ];
80+
81+ // Ensure non-disallowed tags with similar names are NOT filtered
82+ yield ['<scriptfoo> ' , '<scriptfoo> ' ];
83+
7484 // Tags not escaped by default
7585 yield ['<strong> ' , '<strong> ' ];
7686 }
@@ -107,6 +117,11 @@ public static function dataProviderForTestWithCustomSettings(): iterable
107117 yield ['<strong/> ' , '<strong/> ' ];
108118 yield ['<strong /> ' , '<strong /> ' ];
109119
120+ // Newline bypass with custom config
121+ yield ["<strong > " , "<strong > " ];
122+ yield ["<strong \n> " , "<strong \n> " ];
123+ yield ["<strong \t> " , "<strong \t> " ];
124+
110125 // Defaults that I didn't include in my custom config
111126 yield ['<title> ' , '<title> ' ];
112127 yield ['<textarea> ' , '<textarea> ' ];
0 commit comments