Skip to content

Fix invalid nested <select> when sanitizing <optgroup> - #375

Merged
aalmiray merged 1 commit into
OWASP:mainfrom
Shangeeth29:fix-optgroup-nested-select
Jan 15, 2026
Merged

aalmiray merged 1 commit into
OWASP:mainfrom
Shangeeth29:fix-optgroup-nested-select

Conversation

@Shangeeth29

Copy link
Copy Markdown

Problem
When using <optgroup> elements within <select> tags, the HTML sanitizer was incorrectly inserting extra <select> tags, producing invalid HTML.

Input:
My option

Broken Output
My option

Root Cause
Simple typo in HtmlElementTables.java

Fixes #358

Note
Similar behavior was observed with but is not included in this PR.

@Shangeeth29

Copy link
Copy Markdown
Author

Hi @jmanico
Just a gentle nudge on this PR when you get a chance

@jmanico

jmanico commented Jan 15, 2026

Copy link
Copy Markdown
Member

cc @aalmiray @melloware (new leads)

@melloware melloware left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Absolutely approve this is clearly wrong in the code and the correct fix

@aalmiray
aalmiray merged commit f6a4ed1 into OWASP:main Jan 15, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants