From 33359ab36cacb7bf14b382399b2583ced5d00897 Mon Sep 17 00:00:00 2001
From: phillipc <phillipc@gmx.de>
Date: Tue, 21 Apr 2026 19:29:22 +0200
Subject: [PATCH] Fix makeTemplateNode bypassing HTML sanitization

Route <script> template content through validateHTMLInput in
makeTemplateNode so templateSizeLimit, allowScriptTagsInTemplates,
and sanitizeHtmlTemplate checks apply.
---
 packages/binding.foreach/src/foreach.ts | 12 ++++++++++--
 packages/utils/src/dom/html.ts          |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/packages/binding.foreach/src/foreach.ts b/packages/binding.foreach/src/foreach.ts
index 72ef35ce6..1552dd722 100644
--- a/packages/binding.foreach/src/foreach.ts
+++ b/packages/binding.foreach/src/foreach.ts
@@ -5,7 +5,15 @@
 // Employing sound techniques to make a faster Knockout foreach binding.
 // --------
 
-import { arrayForEach, cleanNode, options, virtualElements, domData, domNodeIsContainedBy } from '@tko/utils'
+import {
+  arrayForEach,
+  cleanNode,
+  options,
+  virtualElements,
+  domData,
+  domNodeIsContainedBy,
+  validateHTMLInput
+} from '@tko/utils'
 
 import { isObservable, unwrap, observable } from '@tko/observable'
 
@@ -57,7 +65,7 @@ function makeTemplateNode(sourceNode) {
     parentNode = sourceNode.content
   } else if (sourceNode.tagName === 'SCRIPT') {
     parentNode = document.createElement('div')
-    parentNode.innerHTML = sourceNode.text
+    parentNode.innerHTML = validateHTMLInput(sourceNode.text)
   } else {
     // Anything else e.g. <div>
     parentNode = sourceNode
diff --git a/packages/utils/src/dom/html.ts b/packages/utils/src/dom/html.ts
index 761c34036..7f3636d83 100644
--- a/packages/utils/src/dom/html.ts
+++ b/packages/utils/src/dom/html.ts
@@ -68,7 +68,7 @@ export function parseHtmlFragment(html: string, documentContext?: Document): Nod
 }
 
 const scriptTagPattern = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/i
-function validateHTMLInput(html: string): string {
+export function validateHTMLInput(html: string): string {
   if (!html) return ''
 
   if (options.templateSizeLimit > 0 && html.length > options.templateSizeLimit) {