From 9e055660e693d5b06786653c36e3b3c541d82700 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Thu, 10 Sep 2026 07:51:29 -1000
Subject: [PATCH 1/4] Fail closed when an HTML end tag's effect on foreign
 content is unknown

The context tracker assumed that an integration point between the
current node and the tracked bottom blocks every HTML end tag.  That
holds for end tags searched in the default, list-item and button scopes
and for the "any other end tag" walk, but table scope is bounded only by
html, table and template, so </table>, </td> and the rest of the table
structure reach past foreignObject, desc, mi and annotation-xml to a
table around the foreign content and close all of it.  The tracker kept
its foreign state, honored the self-closing flag on the next tag, and
a dropped element such as <object/> no longer held the text after it.

The HTML end-tag scan also popped through elements in the special
category, where browsers ignore the tag, matched headings only by exact
name although </h1> closes any open heading, popped the elements above a
form on </form>, which only removes the form, and cleared its stack on a
stray end tag although the browser may still be in foreign content, so
the next <svg> inside MathML was taken for an SVG root.

The tracker now enters its existing unknown state, where only <svg/> and
<math/> close themselves, whenever an end tag reaches the HTML rules with
an effect that depends on untracked ancestors, on the insertion mode, or
on the list of active formatting elements: table-scope and template end
tags, formatting end tags across a special element, stray end tags with
nothing tracked in the way, and table, template, select and frameset
start tags at an integration point.  Within the tracked region the walk
follows the spec: the special category for any other end tag, the
scopes for the tags with their own rules, heading cross-matching, and
form removal.  Integration points and annotation-xml bound every scope.

Verified against Chrome on the hand-built cases and on 2000 generated
inputs, where the fix removes every divergence toward foreign state.

Closes #461.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VYF1WjZmwbGNrph7RDw2BS
---
 change_log.md                                 |  12 +
 .../java/org/owasp/html/HtmlSanitizer.java    | 221 ++++++++++++++----
 .../org/owasp/html/HtmlSanitizerTest.java     | 157 ++++++++++++-
 3 files changed, 338 insertions(+), 52 deletions(-)

diff --git a/change_log.md b/change_log.md
index 8a0b07e3..5322f3c0 100644
--- a/change_log.md
+++ b/change_log.md
@@ -2,6 +2,18 @@
 
 Most recent at top.
   * Next release
+    * The context tracker behind self-closing SVG and MathML tags now fails
+      closed when an end tag reaches the HTML rules with an effect it cannot
+      derive from the elements it tracks: end tags processed with table
+      scope (`</table>`, `</td>` and the rest of the table structure),
+      `</h1>` through `</h6>`, `</form>`, a formatting end tag across a
+      special element, a stray end tag that may name an ancestor of the
+      foreign root, and table, `<template>` or `<select>` start tags at an
+      integration point.  From then on only `<svg/>` and `<math/>` close
+      themselves, as before issue #122.  Inside an integration point the
+      tracker follows the special category and the default, list-item and
+      button scopes, so `</foreignObject>` is ignored while an HTML element
+      such as `<div>` is still open inside it, as in browsers.  Issue #461.
     * Self-closing SVG and MathML handling now follows the browser's current
       tree-construction context through HTML integration points, foreign
       content breakout tags, mismatched foreign end tags, and the end tags
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
index 9335c4bb..f7da57ed 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -243,8 +243,11 @@ private static final class ForeignContentContext {
     private final List<OpenElement> openElements = new ArrayList<>();
 
     /**
-     * True once the bounded stack is exhausted.  The legacy HTML behavior is
-     * the conservative fallback for ordinary tags from that point onward.
+     * True once the browser's context can no longer be derived from the
+     * tracked elements: the bounded stack was exhausted, or a tag's effect
+     * depended on untracked ancestors or on the insertion mode.  The legacy
+     * HTML behavior is the conservative fallback for ordinary tags from that
+     * point onward.
      */
     private boolean unknown;
 
@@ -282,58 +285,103 @@ && breaksOutOfForeignContent(elementName, attrs)) {
     void processEndTag(String elementName) {
       if (unknown || openElements.isEmpty()) { return; }
 
-      OpenElement current = currentElement();
-      if (current.namespace == Namespace.HTML) {
-        processHtmlEndTag(elementName);
+      if (currentElement().namespace == Namespace.HTML) {
+        processEndTagUnderHtmlRules(elementName);
         return;
       }
 
       if ("br".equals(elementName) || "p".equals(elementName)) {
         popToHtmlOrIntegrationPoint();
-        processHtmlEndTag(elementName);
+        processEndTagUnderHtmlRules(elementName);
         return;
       }
 
       // The foreign-content end-tag algorithm walks down from the current
       // node.  A foreign node with the tag name closes, along with every
       // node above it.  At the first HTML node the browser reprocesses the
-      // token under the HTML rules instead, where an HTML node with the tag
-      // name closes the same way, but a node in the special category, which
-      // among foreign elements means an integration point, ends the search
-      // and the token is ignored.
-      boolean htmlRules = false;
-      boolean sawIntegrationPoint = false;
+      // token under the rules of its current HTML insertion mode instead.
       for (int i = openElements.size(); --i >= 0;) {
         OpenElement open = openElements.get(i);
-        boolean isHtml = open.namespace == Namespace.HTML;
-        boolean isIntegrationPoint
-            = open.mathTextIntegrationPoint || open.htmlIntegrationPoint;
-        if (isHtml) {
-          htmlRules = true;
-        } else if (htmlRules && isIntegrationPoint) {
+        if (open.namespace == Namespace.HTML) { break; }
+        if (asciiEqualsIgnoreCase(open.elementName, elementName)) {
+          openElements.subList(i, openElements.size()).clear();
           return;
         }
-        if (isHtml == htmlRules
-            && asciiEqualsIgnoreCase(open.elementName, elementName)) {
-          openElements.subList(i, openElements.size()).clear();
+      }
+      processEndTagUnderHtmlRules(elementName);
+    }
+
+    /**
+     * Applies an end tag that a browser processes under the rules of its
+     * current HTML insertion mode.  Only outcomes that follow from the
+     * tracked elements alone are modeled.  Anything that depends on the
+     * untracked ancestors of the foreign root, on the insertion mode, or on
+     * the list of active formatting elements makes the context unknown,
+     * which fails closed: self-closing flags are no longer honored.
+     */
+    private void processEndTagUnderHtmlRules(String elementName) {
+      if (TABLE_SCOPED_ELEMENT_NAMES.contains(elementName)
+          || "template".equals(elementName)) {
+        // Table scope is bounded only by html, table and template, so these
+        // end tags reach past integration points to untracked ancestors,
+        // and what they close depends on the insertion mode.
+        becomeUnknown();
+        return;
+      }
+      if (IGNORED_HTML_END_TAG_NAMES.contains(elementName)) {
+        return;
+      }
+      boolean anyOther = !SPECIFIC_END_TAG_RULE_NAMES.contains(elementName);
+      boolean formatting = FORMATTING_ELEMENT_NAMES.contains(elementName);
+      boolean heading = isHeadingName(elementName);
+      for (int i = openElements.size(); --i >= 0;) {
+        OpenElement open = openElements.get(i);
+        if (open.namespace != Namespace.HTML) {
+          // Integration points and annotation-xml are in the special
+          // category and bound every scope.  Other foreign elements are
+          // transparent to both kinds of search.
+          if (open.special) { return; }
+          continue;
+        }
+        String openName = open.elementName;
+        if (asciiEqualsIgnoreCase(openName, elementName)
+            || (heading && isHeadingName(openName))) {
+          if ("form".equals(elementName)) {
+            // </form> removes the form element without popping the
+            // elements above it.
+            openElements.remove(i);
+          } else {
+            openElements.subList(i, openElements.size()).clear();
+          }
+          return;
+        }
+        if (anyOther) {
+          // "Any other end tag" stops at any element in the special
+          // category.
+          if (SPECIAL_HTML_ELEMENT_NAMES.contains(openName)) { return; }
+          continue;
+        }
+        if (DEFAULT_SCOPE_BOUNDARY_NAMES.contains(openName)
+            || ("li".equals(elementName)
+                && ("ol".equals(openName) || "ul".equals(openName)))
+            || ("p".equals(elementName) && "button".equals(openName))) {
+          // Not in scope: the token is ignored, or for </p> an empty p is
+          // inserted and closed at once.
+          return;
+        }
+        if (formatting && SPECIAL_HTML_ELEMENT_NAMES.contains(openName)) {
+          // The adoption agency algorithm restructures the stack around
+          // this "furthest block", dropping the foreign nodes above it.
+          becomeUnknown();
           return;
         }
-        sawIntegrationPoint |= isIntegrationPoint;
       }
-      // Nothing tracked matched, so the token now applies to the HTML
-      // elements below the first foreign root, which are not tracked.  No
-      // HTML element is named svg or math, and an integration point in
-      // between is special and stops the search, so the browser ignores the
-      // token in those cases.  Otherwise the named element may well be
-      // open below, in which case the browser closes it and every foreign
-      // element above it.  Assume that it is: the cost of guessing wrong is
-      // only that self-closing flags stop being honored in the rest of an
-      // svg or math element whose author wrote a stray end tag, which is
-      // how those tags were always processed before the flag was honored.
-      if (isForeignContentRoot(elementName) || sawIntegrationPoint) {
+      if (openElements.isEmpty() || "form".equals(elementName)) {
         return;
       }
-      openElements.clear();
+      // Nothing tracked bounded the search, so whether the token closes the
+      // whole foreign region depends on the untracked HTML ancestors.
+      becomeUnknown();
     }
 
     private boolean processHtmlStartTag(
@@ -344,9 +392,15 @@ private boolean processHtmlStartTag(
       } else if ("math".equals(elementName)) {
         namespace = Namespace.MATHML;
       } else {
-        if (!openElements.isEmpty()
-            && !HtmlTextEscapingMode.isVoidElement(elementName)) {
-          push(new OpenElement(elementName, Namespace.HTML, attrs));
+        if (!openElements.isEmpty()) {
+          if (CONTEXT_CHANGING_START_TAG_NAMES.contains(elementName)) {
+            // Table structure, templates and selects change the insertion
+            // mode or pop the stack in ways that depend on untracked state.
+            becomeUnknown();
+          } else if (!HtmlTextEscapingMode.isVoidElement(elementName)
+                     && !IGNORED_HTML_START_TAG_NAMES.contains(elementName)) {
+            push(new OpenElement(elementName, Namespace.HTML, attrs));
+          }
         }
         // HTML ignores the self-closing flag on ordinary non-void elements.
         // Void elements are already empty and need no synthetic close event.
@@ -359,15 +413,9 @@ private boolean processHtmlStartTag(
       return selfClosing;
     }
 
-    private void processHtmlEndTag(String elementName) {
-      for (int i = openElements.size(); --i >= 0;) {
-        OpenElement open = openElements.get(i);
-        if (open.namespace != Namespace.HTML) { return; }
-        if (asciiEqualsIgnoreCase(open.elementName, elementName)) {
-          openElements.subList(i, openElements.size()).clear();
-          return;
-        }
-      }
+    private void becomeUnknown() {
+      openElements.clear();
+      unknown = true;
     }
 
     private void popToHtmlOrIntegrationPoint() {
@@ -384,8 +432,7 @@ private void popToHtmlOrIntegrationPoint() {
 
     private void push(OpenElement element) {
       if (openElements.size() == MAX_DEPTH) {
-        openElements.clear();
-        unknown = true;
+        becomeUnknown();
       } else {
         openElements.add(element);
       }
@@ -425,6 +472,8 @@ private static final class OpenElement {
     final Namespace namespace;
     final boolean mathTextIntegrationPoint;
     final boolean htmlIntegrationPoint;
+    /** In the special category, which bounds every scope. */
+    final boolean special;
 
     OpenElement(
         String elementName, Namespace namespace, List<String> attrs) {
@@ -434,6 +483,9 @@ private static final class OpenElement {
           && MATHML_TEXT_INTEGRATION_POINT_NAMES.contains(elementName);
       this.htmlIntegrationPoint = isHtmlIntegrationPoint(
           elementName, namespace, attrs);
+      this.special = mathTextIntegrationPoint || htmlIntegrationPoint
+          || (namespace == Namespace.MATHML
+              && "annotation-xml".equals(elementName));
     }
   }
 
@@ -486,6 +538,79 @@ private static boolean breaksOutOfForeignContent(
     return false;
   }
 
+
+  /** True for h1 through h6, any of which an h1 through h6 end tag closes. */
+  private static boolean isHeadingName(String canonElementName) {
+    if (canonElementName.length() != 2 || canonElementName.charAt(0) != 'h') {
+      return false;
+    }
+    char digit = canonElementName.charAt(1);
+    return digit >= '1' && digit <= '6';
+  }
+
+  /** End tags whose effect is decided by table scope or the insertion mode. */
+  private static final Set<String> TABLE_SCOPED_ELEMENT_NAMES
+      = j8().setOf(
+          "table", "caption", "tbody", "thead", "tfoot", "tr", "td", "th");
+
+  /** HTML end tags that never pop the stack. */
+  private static final Set<String> IGNORED_HTML_END_TAG_NAMES
+      = j8().setOf(
+          "svg", "math", "body", "html", "br", "col", "colgroup", "frame",
+          "head");
+
+  /**
+   * End tags with their own "in body" rules, which search a scope rather
+   * than stopping at the first element in the special category.
+   */
+  private static final Set<String> SPECIFIC_END_TAG_RULE_NAMES
+      = j8().setOf(
+          "address", "article", "aside", "blockquote", "button", "center",
+          "details", "dialog", "dir", "div", "dl", "fieldset", "figcaption",
+          "figure", "footer", "header", "hgroup", "listing", "main", "menu",
+          "nav", "ol", "pre", "search", "section", "summary", "ul", "form",
+          "p", "li", "dd", "dt", "h1", "h2", "h3", "h4", "h5", "h6",
+          "a", "b", "big", "code", "em", "font", "i", "nobr", "s", "small",
+          "strike", "strong", "tt", "u", "applet", "marquee", "object");
+
+  private static final Set<String> FORMATTING_ELEMENT_NAMES
+      = j8().setOf(
+          "a", "b", "big", "code", "em", "font", "i", "nobr", "s", "small",
+          "strike", "strong", "tt", "u");
+
+  /** The HTML elements that bound the default scope. */
+  private static final Set<String> DEFAULT_SCOPE_BOUNDARY_NAMES
+      = j8().setOf(
+          "applet", "caption", "html", "table", "td", "th", "marquee",
+          "object", "select", "template");
+
+  /** The HTML elements in the special category. */
+  private static final Set<String> SPECIAL_HTML_ELEMENT_NAMES
+      = j8().setOf(
+          "address", "applet", "area", "article", "aside", "base",
+          "basefont", "bgsound", "blockquote", "body", "br", "button",
+          "caption", "center", "col", "colgroup", "dd", "details", "dir",
+          "div", "dl", "dt", "embed", "fieldset", "figcaption", "figure",
+          "footer", "form", "frame", "frameset", "h1", "h2", "h3", "h4",
+          "h5", "h6", "head", "header", "hgroup", "hr", "html", "iframe",
+          "img", "input", "keygen", "li", "link", "listing", "main",
+          "marquee", "menu", "meta", "nav", "noembed", "noframes",
+          "noscript", "object", "ol", "p", "param", "plaintext", "pre",
+          "script", "search", "section", "select", "source", "style",
+          "summary", "table", "tbody", "td", "template", "textarea",
+          "tfoot", "th", "thead", "title", "tr", "track", "ul", "wbr",
+          "xmp");
+
+  /** Start tags inside foreign content whose effect depends on the mode. */
+  private static final Set<String> CONTEXT_CHANGING_START_TAG_NAMES
+      = j8().setOf(
+          "table", "caption", "col", "colgroup", "tbody", "thead", "tfoot",
+          "tr", "td", "th", "template", "select", "frameset");
+
+  /** Start tags that "in body" ignores or merges rather than inserting. */
+  private static final Set<String> IGNORED_HTML_START_TAG_NAMES
+      = j8().setOf("html", "body", "head", "frame");
+
   private static final Set<String> MATHML_TEXT_INTEGRATION_POINT_NAMES
       = j8().setOf("mi", "mo", "mn", "ms", "mtext");
 
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index fcbd72e1..1c9d8e64 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -972,9 +972,9 @@ void testForeignContentEndTagsUpdateTheMatchingContext() {
 
   /**
    * Issue #457.  An end tag that names none of the open foreign elements
-   * may close an HTML ancestor of the foreign root, which is not tracked,
-   * so the parser is assumed to be back in HTML content unless the browser
-   * would ignore the tag.
+   * may close an HTML ancestor of the foreign root, which is not tracked.
+   * The context is then unknown and the sanitizer falls back to the HTML
+   * rules, unless the browser would ignore the tag.
    */
   @Test
   void testEndTagsOfHtmlAncestorsEndForeignContent() {
@@ -1134,6 +1134,154 @@ public void closeTag(String elementName) {
         events);
   }
 
+  /**
+   * Issue #461.  Browsers process the end tags of table structure with
+   * table scope, which no integration point bounds, so they close the
+   * foreign content around a cell along with the cell.  The tracker cannot
+   * see the table, so it fails closed for the rest of the input.
+   */
+  @Test
+  void testTableScopeEndTagsEndForeignContent() {
+    PolicyFactory p = foreignContentPolicy();
+    for (String endTag
+         : new String[] { "</table>", "</tbody>", "</tr>", "</td>" }) {
+      assertEquals(
+          "<svg><foreignObject><svg></svg></foreignObject></svg>",
+          p.sanitize(
+              "<table><tbody><tr><td><svg><foreignObject><svg>" + endTag
+              + "<object/>hidden"),
+          endTag);
+    }
+    assertEquals(
+        "<svg><foreignObject><svg></svg></foreignObject></svg>",
+        p.sanitize(
+            "<table><caption><svg><foreignObject><svg></caption>"
+            + "<object/>hidden"));
+    assertEquals(
+        "<svg><desc><svg></svg></desc></svg>",
+        p.sanitize("<table><tr><td><svg><desc><svg></table><object/>hidden"));
+    assertEquals(
+        "<math><mi><svg></svg></mi></math>",
+        p.sanitize("<table><tr><td><math><mi><svg></table><object/>hidden"));
+    assertEquals(
+        "<math><annotation-xml encoding=\"text/html\"><svg></svg>"
+        + "</annotation-xml></math>",
+        p.sanitize(
+            "<table><tr><td><math><annotation-xml encoding=text/html><svg>"
+            + "</table><object/>hidden"));
+    // The context stays unknown, so a later self-closing tag is not honored
+    // either.
+    assertEquals(
+        "<svg><foreignObject><svg></svg></foreignObject></svg>"
+        + "<svg><path>x</path></svg>",
+        p.sanitize(
+            "<table><tr><td><svg><foreignObject><svg></table><svg><path/>x"));
+    // Table structure inside an integration point implies elements the
+    // tracker does not see, so it fails closed at the start tag.
+    assertEquals(
+        "<svg><foreignObject><svg></svg></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><table><tr><td><svg></tbody>"
+            + "<object/>hidden"));
+    assertEquals(
+        "<svg><foreignObject><svg></svg></foreignObject></svg>",
+        p.sanitize("<svg><foreignObject><select><svg><object/>hidden"));
+    // An end tag searched in the default or list-item scope stops at the
+    // integration point, so a browser ignores it and the dropped element
+    // still closes itself in foreign content.
+    assertEquals(
+        "<svg><foreignObject><svg></svg></foreignObject></svg>shown",
+        p.sanitize(
+            "<ul><li><svg><foreignObject><svg></li><object/>shown"));
+  }
+
+  /**
+   * Issue #461.  Under the HTML rules an end tag search stops at an element
+   * in the special category, so the elements above it stay open, and the
+   * end tag of the integration point holding them is ignored while they do.
+   */
+  @Test
+  void testSpecialElementsBlockHtmlEndTagsInForeignContent() {
+    PolicyFactory p = foreignContentPolicy();
+    assertEquals(
+        "<svg><foreignObject><cite><div></div></cite></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><cite><div></cite></foreignObject>"
+            + "<object/>hidden"));
+    assertEquals(
+        "<math><mi><cite><div></div></cite></mi></math>",
+        p.sanitize("<math><mi><cite><div></cite></mi><object/>hidden"));
+    // A td start tag is ignored in body, but the div it seems to hold is
+    // still special.
+    assertEquals(
+        "<svg><foreignObject><div></div></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><td><div></td></foreignObject>"
+            + "<object/>hidden"));
+    // Without a special element in the way the end tags match, the
+    // integration point closes, and the flag is honored again.
+    assertEquals(
+        "<svg><foreignObject><cite><kbd></kbd></cite></foreignObject>"
+        + "<path></path>x</svg>",
+        p.sanitize(
+            "<svg><foreignObject><cite><kbd></cite></foreignObject>"
+            + "<path/>x"));
+    // Any h1 through h6 end tag closes an open heading.
+    assertEquals(
+        "<svg><foreignObject><h2><svg></svg></h2></foreignObject></svg>",
+        p.sanitize("<svg><foreignObject><h2><svg></h1><object/>hidden"));
+    // </form> removes the form without closing what it holds.
+    assertEquals(
+        "<svg><foreignObject><form><cite></cite></form></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><form><cite></form></foreignObject>"
+            + "<object/>hidden"));
+    assertEquals(
+        "<svg><foreignObject><form><svg></svg></form>shown</foreignObject>"
+        + "</svg>",
+        p.sanitize(
+            "<svg><foreignObject><form><svg></form><object/>shown"));
+    // The adoption agency algorithm rebuilds the stack around a special
+    // element and drops the foreign nodes above it.
+    assertEquals(
+        "<svg><foreignObject><b><div><svg></svg></div></b></foreignObject>"
+        + "</svg>",
+        p.sanitize(
+            "<svg><foreignObject><b><div><svg></b></foreignObject>"
+            + "<object/>hidden"));
+    // When a special element blocks the end tag, the foreign element above
+    // it is still the current node, where the flag is honored.
+    assertEquals(
+        "<svg><foreignObject><cite><div><svg></svg></div></cite>shown"
+        + "</foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><cite><div><svg></cite><object/>shown"));
+  }
+
+  /**
+   * Issue #461.  After a stray end tag the tracker cannot tell whether the
+   * browser left the foreign content, and the next svg start tag inside
+   * MathML is a MathML element whose foreignObject is not an integration
+   * point, so the tracker stays unknown rather than starting over.
+   */
+  @Test
+  void testStrayEndTagLeavesForeignContentContextUnknown() {
+    PolicyFactory p = foreignContentPolicy();
+    assertEquals(
+        "<math><mrow><svg><foreignObject><div></div></foreignObject></svg>"
+        + "</mrow></math>",
+        p.sanitize(
+            "<math><mrow></foo><svg><foreignObject><div></div>"
+            + "</foreignObject><object/>hidden"));
+    assertEquals(
+        "<svg><g></g></svg><svg><path>x</path></svg>",
+        p.sanitize("<svg><g></foo></g></svg><svg><path/>x</svg>"));
+    // A self-closing root is still empty in every context.
+    assertEquals(
+        "<svg><g></g></svg><svg></svg>x",
+        p.sanitize("<svg><g></foo></g></svg><svg/>x"));
+  }
+
   /** The bounded context tracker falls back to suppressing dropped content. */
   @Test
   void testDeepForeignContentContextFailsClosed() {
@@ -1150,7 +1298,8 @@ private static PolicyFactory foreignContentPolicy() {
         .allowElements(
             "svg", "math", "path", "g", "rect", "clipPath", "foreignObject",
             "desc", "annotation-xml", "textArea", "textarea", "mi", "mrow",
-            "mglyph", "a", "div", "p", "font", "br", "style", "title")
+            "mglyph", "a", "div", "p", "font", "br", "style", "title",
+            "cite", "kbd", "b", "h2", "form")
         .allowAttributes("width", "height", "viewBox").onElements("svg")
         .allowAttributes("id", "opacity", "d").onElements("path")
         .allowAttributes("href").onElements("a")

From 5a5c0c6a2f30106baa828d6b61ec6a8258b8babb Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Thu, 10 Sep 2026 09:19:11 -1000
Subject: [PATCH 2/4] Track HTML stack mutations in foreign content

---
 change_log.md                                 |  23 +-
 .../java/org/owasp/html/HtmlSanitizer.java    | 444 +++++++++++++++++-
 .../org/owasp/html/HtmlSanitizerTest.java     | 116 ++++-
 3 files changed, 541 insertions(+), 42 deletions(-)

diff --git a/change_log.md b/change_log.md
index 5322f3c0..0ae3de98 100644
--- a/change_log.md
+++ b/change_log.md
@@ -2,18 +2,17 @@
 
 Most recent at top.
   * Next release
-    * The context tracker behind self-closing SVG and MathML tags now fails
-      closed when an end tag reaches the HTML rules with an effect it cannot
-      derive from the elements it tracks: end tags processed with table
-      scope (`</table>`, `</td>` and the rest of the table structure),
-      `</h1>` through `</h6>`, `</form>`, a formatting end tag across a
-      special element, a stray end tag that may name an ancestor of the
-      foreign root, and table, `<template>` or `<select>` start tags at an
-      integration point.  From then on only `<svg/>` and `<math/>` close
-      themselves, as before issue #122.  Inside an integration point the
-      tracker follows the special category and the default, list-item and
-      button scopes, so `</foreignObject>` is ignored while an HTML element
-      such as `<div>` is still open inside it, as in browsers.  Issue #461.
+    * The context tracker behind self-closing SVG and MathML tags now follows
+      the HTML start- and end-tag rules that can change the open-element
+      stack inside an integration point, including p, list, heading, button,
+      form, formatting, select and option rules.  It also tracks the form
+      pointer and inherited table or cell mode, and uses the current parser's
+      element categories rather than legacy void-element classifications.
+      When an outcome still depends on untracked table or template state or
+      on the active formatting list, it fails closed so only `<svg/>` and
+      `<math/>` close themselves.  Well-formed select and empty-table HTML
+      islands no longer make later SVG unnecessarily use that fallback.
+      Issue #461.
     * Self-closing SVG and MathML handling now follows the browser's current
       tree-construction context through HTML integration points, foreign
       content breakout tags, mismatched foreign end tags, and the end tags
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
index f7da57ed..ef291b3e 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -242,6 +242,25 @@ private static final class ForeignContentContext {
     /** Elements from the first open foreign root through the current node. */
     private final List<OpenElement> openElements = new ArrayList<>();
 
+    /** The form pointer is not bounded by an integration point. */
+    private boolean formElementPointerSet;
+
+    /** The form pointer's target, when that element is in the tracked region. */
+    private @Nullable OpenElement trackedFormElement;
+
+    /** A table inserted in known in-body mode, before any child tag. */
+    private @Nullable OpenElement simpleTable;
+
+    /** The mode to restore when {@link #simpleTable} closes. */
+    private HtmlInsertionMode simpleTableReturnMode
+        = HtmlInsertionMode.IN_BODY;
+
+    /** The HTML mode that remains in force while foreign rules run. */
+    private HtmlInsertionMode htmlInsertionMode = HtmlInsertionMode.IN_BODY;
+
+    /** Whether an untracked table is known to be in table scope. */
+    private boolean untrackedTableInScope;
+
     /**
      * True once the browser's context can no longer be derived from the
      * tracked elements: the bounded stack was exhausted, or a tag's effect
@@ -283,7 +302,15 @@ && breaksOutOfForeignContent(elementName, attrs)) {
 
     /** Updates the context using the foreign-content or HTML end-tag rules. */
     void processEndTag(String elementName) {
-      if (unknown || openElements.isEmpty()) { return; }
+      if (unknown) { return; }
+      if (openElements.isEmpty()) {
+        if ("form".equals(elementName)) {
+          formElementPointerSet = false;
+          trackedFormElement = null;
+        }
+        trackUntrackedHtmlEndTag(elementName);
+        return;
+      }
 
       if (currentElement().namespace == Namespace.HTML) {
         processEndTagUnderHtmlRules(elementName);
@@ -320,6 +347,17 @@ void processEndTag(String elementName) {
      * which fails closed: self-closing flags are no longer honored.
      */
     private void processEndTagUnderHtmlRules(String elementName) {
+      if (simpleTable != null) {
+        if ("table".equals(elementName)
+            && currentElement() == simpleTable) {
+          openElements.remove(openElements.size() - 1);
+          simpleTable = null;
+          htmlInsertionMode = simpleTableReturnMode;
+        } else {
+          becomeUnknown();
+        }
+        return;
+      }
       if (TABLE_SCOPED_ELEMENT_NAMES.contains(elementName)
           || "template".equals(elementName)) {
         // Table scope is bounded only by html, table and template, so these
@@ -331,6 +369,21 @@ private void processEndTagUnderHtmlRules(String elementName) {
       if (IGNORED_HTML_END_TAG_NAMES.contains(elementName)) {
         return;
       }
+      if ("form".equals(elementName)) {
+        OpenElement form = trackedFormElement;
+        formElementPointerSet = false;
+        trackedFormElement = null;
+        if (form != null) {
+          int formIndex = openElements.indexOf(form);
+          if (formIndex >= 0 && isInDefaultScope(formIndex)) {
+            // Outside template contents, </form> removes the form without
+            // popping the elements above it.
+            generateImpliedEndTags(null);
+            openElements.remove(formIndex);
+          }
+        }
+        return;
+      }
       boolean anyOther = !SPECIFIC_END_TAG_RULE_NAMES.contains(elementName);
       boolean formatting = FORMATTING_ELEMENT_NAMES.contains(elementName);
       boolean heading = isHeadingName(elementName);
@@ -346,12 +399,11 @@ private void processEndTagUnderHtmlRules(String elementName) {
         String openName = open.elementName;
         if (asciiEqualsIgnoreCase(openName, elementName)
             || (heading && isHeadingName(openName))) {
-          if ("form".equals(elementName)) {
-            // </form> removes the form element without popping the
-            // elements above it.
-            openElements.remove(i);
-          } else {
-            openElements.subList(i, openElements.size()).clear();
+          if (!popTrackedElementsFrom(
+              i,
+              ACTIVE_FORMATTING_MARKER_ELEMENT_NAMES.contains(elementName),
+              formatting ? open : null)) {
+            return;
           }
           return;
         }
@@ -376,7 +428,7 @@ private void processEndTagUnderHtmlRules(String elementName) {
           return;
         }
       }
-      if (openElements.isEmpty() || "form".equals(elementName)) {
+      if (openElements.isEmpty()) {
         return;
       }
       // Nothing tracked bounded the search, so whether the token closes the
@@ -386,21 +438,154 @@ private void processEndTagUnderHtmlRules(String elementName) {
 
     private boolean processHtmlStartTag(
         String elementName, List<String> attrs, boolean selfClosing) {
+      if (simpleTable != null) {
+        // A child start tag is where the in-table modes start implying or
+        // foster-parenting elements.  Keep the empty-table case exact and
+        // fail closed for the rest.
+        becomeUnknown();
+        return false;
+      }
+
       Namespace namespace;
       if ("svg".equals(elementName)) {
         namespace = Namespace.SVG;
       } else if ("math".equals(elementName)) {
         namespace = Namespace.MATHML;
       } else {
-        if (!openElements.isEmpty()) {
-          if (CONTEXT_CHANGING_START_TAG_NAMES.contains(elementName)) {
-            // Table structure, templates and selects change the insertion
-            // mode or pop the stack in ways that depend on untracked state.
+        if (openElements.isEmpty()) {
+          trackUntrackedHtmlStartTag(elementName);
+        }
+        if (htmlInsertionMode == HtmlInsertionMode.UNKNOWN) {
+          becomeUnknown();
+          return false;
+        }
+        if (UNMODELED_CONTEXT_CHANGING_START_TAG_NAMES.contains(elementName)) {
+          becomeUnknown();
+          return false;
+        }
+        if ("form".equals(elementName)) {
+          if (htmlInsertionMode == HtmlInsertionMode.IN_TABLE) {
+            // "In table" inserts a new form and immediately pops it.
+            if (!formElementPointerSet) {
+              formElementPointerSet = true;
+              trackedFormElement = null;
+            }
+            return false;
+          }
+          processFormStartTag(attrs);
+          return false;
+        }
+        if (openElements.isEmpty()) {
+          return false;
+        }
+        if (TABLE_STRUCTURE_START_TAG_NAMES.contains(elementName)) {
+          if (htmlInsertionMode != HtmlInsertionMode.IN_BODY) {
+            becomeUnknown();
+          }
+          return false;
+        }
+        if (P_CLOSING_START_TAG_NAMES.contains(elementName)
+            || "pre".equals(elementName)
+            || "listing".equals(elementName)
+            || "plaintext".equals(elementName)) {
+          if (!closePIfInButtonScope()) { return false; }
+        } else if (isHeadingName(elementName)) {
+          if (!closePIfInButtonScope()) { return false; }
+          OpenElement current = currentElement();
+          if (current.namespace == Namespace.HTML
+              && isHeadingName(current.elementName)) {
+            openElements.remove(openElements.size() - 1);
+          }
+        } else if ("li".equals(elementName)) {
+          if (!closeListOrDescriptionItemForStart(true)
+              || !closePIfInButtonScope()) {
+            return false;
+          }
+        } else if ("dd".equals(elementName) || "dt".equals(elementName)) {
+          if (!closeListOrDescriptionItemForStart(false)
+              || !closePIfInButtonScope()) {
+            return false;
+          }
+        } else if ("button".equals(elementName)) {
+          int buttonIndex = findHtmlElementInDefaultScope("button", true);
+          if (buttonIndex >= 0) {
+            if (!popTrackedElementsFrom(buttonIndex, false, null)) {
+              return false;
+            }
+          }
+        } else if ("a".equals(elementName)) {
+          if (findOpenHtmlElement("a") >= 0) {
+            becomeUnknown();
+            return false;
+          }
+        } else if ("nobr".equals(elementName)) {
+          if (findHtmlElementInDefaultScope("nobr", false) >= 0) {
+            becomeUnknown();
+            return false;
+          }
+        } else if ("select".equals(elementName)) {
+          int selectIndex = findHtmlElementInDefaultScope("select", false);
+          if (selectIndex >= 0) {
+            // A nested select start tag is ignored after popping the first.
+            if (!popTrackedElementsFrom(selectIndex, false, null)) {
+              return false;
+            }
+            return false;
+          }
+        } else if ("option".equals(elementName)) {
+          if (findHtmlElementInDefaultScope("select", false) >= 0) {
+            generateImpliedEndTags("optgroup");
+          } else if (isCurrentHtmlElement("option")) {
+            openElements.remove(openElements.size() - 1);
+          }
+        } else if ("optgroup".equals(elementName)) {
+          if (findHtmlElementInDefaultScope("select", false) >= 0) {
+            generateImpliedEndTags(null);
+          } else if (isCurrentHtmlElement("option")) {
+            openElements.remove(openElements.size() - 1);
+          }
+        } else if ("input".equals(elementName)) {
+          if (htmlInsertionMode == HtmlInsertionMode.IN_TABLE
+              && hasHiddenInputType(attrs)) {
+            return false;
+          }
+          int selectIndex = findHtmlElementInDefaultScope("select", false);
+          if (selectIndex >= 0) {
+            if (!popTrackedElementsFrom(selectIndex, false, null)) {
+              return false;
+            }
+          }
+        } else if ("hr".equals(elementName)) {
+          if (!closePIfInButtonScope()) { return false; }
+          if (findHtmlElementInDefaultScope("select", false) >= 0) {
+            generateImpliedEndTags(null);
+          }
+        } else if (UNMODELED_HTML_START_TAG_NAMES.contains(elementName)) {
+          becomeUnknown();
+          return false;
+        } else if ("image".equals(elementName)) {
+          // The in-body rules rewrite image to the void img element.
+          return false;
+        } else if ("table".equals(elementName)) {
+          if (htmlInsertionMode == HtmlInsertionMode.IN_TABLE) {
             becomeUnknown();
-          } else if (!HtmlTextEscapingMode.isVoidElement(elementName)
-                     && !IGNORED_HTML_START_TAG_NAMES.contains(elementName)) {
-            push(new OpenElement(elementName, Namespace.HTML, attrs));
+            return false;
           }
+          if (!closePIfInButtonScope()) { return false; }
+          OpenElement table = new OpenElement(
+              elementName, Namespace.HTML, attrs);
+          push(table);
+          if (!unknown) {
+            simpleTable = table;
+            simpleTableReturnMode = htmlInsertionMode;
+            htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+          }
+          return false;
+        }
+
+        if (!HTML_TREE_BUILDER_VOID_ELEMENT_NAMES.contains(elementName)
+            && !IGNORED_HTML_START_TAG_NAMES.contains(elementName)) {
+          push(new OpenElement(elementName, Namespace.HTML, attrs));
         }
         // HTML ignores the self-closing flag on ordinary non-void elements.
         // Void elements are already empty and need no synthetic close event.
@@ -413,8 +598,182 @@ private boolean processHtmlStartTag(
       return selfClosing;
     }
 
+    private void trackUntrackedHtmlStartTag(String elementName) {
+      if ("table".equals(elementName)) {
+        if (!untrackedTableInScope) {
+          untrackedTableInScope = true;
+          htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+        } else if (htmlInsertionMode == HtmlInsertionMode.IN_CELL) {
+          // This is a nested table; its eventual end tag needs a mode stack.
+          htmlInsertionMode = HtmlInsertionMode.UNKNOWN;
+        }
+        return;
+      }
+      if (!untrackedTableInScope) { return; }
+      if ("td".equals(elementName) || "th".equals(elementName)) {
+        htmlInsertionMode = HtmlInsertionMode.IN_CELL;
+      } else if ("caption".equals(elementName)) {
+        // Caption uses body rules for most tokens, but not for table-family
+        // starts, so keep the distinction conservative.
+        htmlInsertionMode = HtmlInsertionMode.UNKNOWN;
+      } else if (TABLE_STRUCTURE_START_TAG_NAMES.contains(elementName)) {
+        htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+      }
+    }
+
+    private void trackUntrackedHtmlEndTag(String elementName) {
+      if (!untrackedTableInScope) { return; }
+      if ("table".equals(elementName)) {
+        if (htmlInsertionMode != HtmlInsertionMode.UNKNOWN) {
+          untrackedTableInScope = false;
+          htmlInsertionMode = HtmlInsertionMode.IN_BODY;
+        }
+      } else if (TABLE_SCOPED_ELEMENT_NAMES.contains(elementName)) {
+        htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+      }
+    }
+
+    private void processFormStartTag(List<String> attrs) {
+      if (formElementPointerSet) { return; }
+      formElementPointerSet = true;
+      if (openElements.isEmpty()) { return; }
+      if (!closePIfInButtonScope()) { return; }
+      OpenElement form = new OpenElement("form", Namespace.HTML, attrs);
+      push(form);
+      if (!unknown) { trackedFormElement = form; }
+    }
+
+    private boolean closePIfInButtonScope() {
+      int pIndex = findHtmlElementInDefaultScope("p", true);
+      if (pIndex >= 0) {
+        return popTrackedElementsFrom(pIndex, false, null);
+      }
+      return true;
+    }
+
+    private boolean closeListOrDescriptionItemForStart(boolean listItem) {
+      for (int i = openElements.size(); --i >= 0;) {
+        OpenElement open = openElements.get(i);
+        if (open.namespace == Namespace.HTML
+            && (listItem
+                ? "li".equals(open.elementName)
+                : "dd".equals(open.elementName)
+                    || "dt".equals(open.elementName))) {
+          return popTrackedElementsFrom(i, false, null);
+        }
+        if (isSpecial(open)
+            && !isHtmlElement(open, "address")
+            && !isHtmlElement(open, "div")
+            && !isHtmlElement(open, "p")) {
+          return true;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * Pops a known suffix, or fails closed if doing so leaves formatting
+     * elements only in the active formatting list.  A later start tag could
+     * reconstruct those elements and put Chrome back in HTML content while
+     * this bounded tracker believed that the current node was foreign.
+     */
+    private boolean popTrackedElementsFrom(
+        int fromIndex,
+        boolean allFormattingEntriesAreCleared,
+        @Nullable OpenElement oneFormattingEntryRemoved) {
+      if (!allFormattingEntriesAreCleared) {
+        for (int i = openElements.size(); --i >= fromIndex;) {
+          OpenElement open = openElements.get(i);
+          if (open.namespace == Namespace.HTML
+              && FORMATTING_ELEMENT_NAMES.contains(open.elementName)
+              && open != oneFormattingEntryRemoved) {
+            becomeUnknown();
+            return false;
+          }
+        }
+      }
+      openElements.subList(fromIndex, openElements.size()).clear();
+      return true;
+    }
+
+    private void generateImpliedEndTags(@Nullable String except) {
+      while (!openElements.isEmpty()) {
+        OpenElement current = currentElement();
+        if (current.namespace != Namespace.HTML
+            || !IMPLIED_END_TAG_NAMES.contains(current.elementName)
+            || current.elementName.equals(except)) {
+          return;
+        }
+        openElements.remove(openElements.size() - 1);
+      }
+    }
+
+    private int findHtmlElementInDefaultScope(
+        String elementName, boolean buttonScope) {
+      for (int i = openElements.size(); --i >= 0;) {
+        OpenElement open = openElements.get(i);
+        if (isHtmlElement(open, elementName)) { return i; }
+        if (open.namespace != Namespace.HTML) {
+          if (open.special) { return -1; }
+        } else if (DEFAULT_SCOPE_BOUNDARY_NAMES.contains(open.elementName)
+                   || (buttonScope && "button".equals(open.elementName))) {
+          return -1;
+        }
+      }
+      return -1;
+    }
+
+    private boolean isInDefaultScope(int targetIndex) {
+      for (int i = openElements.size(); --i > targetIndex;) {
+        OpenElement open = openElements.get(i);
+        if (open.namespace != Namespace.HTML) {
+          if (open.special) { return false; }
+        } else if (DEFAULT_SCOPE_BOUNDARY_NAMES.contains(open.elementName)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    private int findOpenHtmlElement(String elementName) {
+      for (int i = openElements.size(); --i >= 0;) {
+        if (isHtmlElement(openElements.get(i), elementName)) { return i; }
+      }
+      return -1;
+    }
+
+    private boolean isCurrentHtmlElement(String elementName) {
+      return isHtmlElement(currentElement(), elementName);
+    }
+
+    private static boolean isHtmlElement(
+        OpenElement open, String elementName) {
+      return open.namespace == Namespace.HTML
+          && elementName.equals(open.elementName);
+    }
+
+    private static boolean isSpecial(OpenElement open) {
+      return open.namespace == Namespace.HTML
+          ? SPECIAL_HTML_ELEMENT_NAMES.contains(open.elementName)
+          : open.special;
+    }
+
+    private static boolean hasHiddenInputType(List<String> attrs) {
+      for (int i = 0; i + 1 < attrs.size(); i += 2) {
+        if ("type".equals(attrs.get(i))
+            && asciiEqualsIgnoreCase("hidden", attrs.get(i + 1))) {
+          return true;
+        }
+      }
+      return false;
+    }
+
     private void becomeUnknown() {
       openElements.clear();
+      formElementPointerSet = false;
+      trackedFormElement = null;
+      simpleTable = null;
+      untrackedTableInScope = false;
       unknown = true;
     }
 
@@ -460,6 +819,13 @@ private static boolean usesHtmlRulesForStartTag(
     }
   }
 
+  private enum HtmlInsertionMode {
+    IN_BODY,
+    IN_TABLE,
+    IN_CELL,
+    UNKNOWN,
+  }
+
   private enum Namespace {
     HTML,
     SVG,
@@ -568,8 +934,9 @@ private static boolean isHeadingName(String canonElementName) {
           "address", "article", "aside", "blockquote", "button", "center",
           "details", "dialog", "dir", "div", "dl", "fieldset", "figcaption",
           "figure", "footer", "header", "hgroup", "listing", "main", "menu",
-          "nav", "ol", "pre", "search", "section", "summary", "ul", "form",
-          "p", "li", "dd", "dt", "h1", "h2", "h3", "h4", "h5", "h6",
+          "nav", "ol", "pre", "search", "section", "select", "summary",
+          "ul", "form", "p", "li", "dd", "dt", "h1", "h2", "h3", "h4",
+          "h5", "h6",
           "a", "b", "big", "code", "em", "font", "i", "nobr", "s", "small",
           "strike", "strong", "tt", "u", "applet", "marquee", "object");
 
@@ -578,6 +945,10 @@ private static boolean isHeadingName(String canonElementName) {
           "a", "b", "big", "code", "em", "font", "i", "nobr", "s", "small",
           "strike", "strong", "tt", "u");
 
+  /** Elements whose end tags clear the active formatting list to a marker. */
+  private static final Set<String> ACTIVE_FORMATTING_MARKER_ELEMENT_NAMES
+      = j8().setOf("applet", "marquee", "object");
+
   /** The HTML elements that bound the default scope. */
   private static final Set<String> DEFAULT_SCOPE_BOUNDARY_NAMES
       = j8().setOf(
@@ -601,15 +972,44 @@ private static boolean isHeadingName(String canonElementName) {
           "tfoot", "th", "thead", "title", "tr", "track", "ul", "wbr",
           "xmp");
 
-  /** Start tags inside foreign content whose effect depends on the mode. */
-  private static final Set<String> CONTEXT_CHANGING_START_TAG_NAMES
+  /** Start tags whose HTML stack effect this bounded tracker cannot derive. */
+  private static final Set<String> UNMODELED_CONTEXT_CHANGING_START_TAG_NAMES
+      = j8().setOf("template", "frameset");
+
+  /** Ruby starts generate implied end tags using state outside this tracker. */
+  private static final Set<String> UNMODELED_HTML_START_TAG_NAMES
+      = j8().setOf("rb", "rtc", "rp", "rt");
+
+  /** Start tags that close a p element in button scope before insertion. */
+  private static final Set<String> P_CLOSING_START_TAG_NAMES
+      = j8().setOf(
+          "address", "article", "aside", "blockquote", "center", "details",
+          "dialog", "dir", "div", "dl", "fieldset", "figcaption", "figure",
+          "footer", "header", "hgroup", "main", "menu", "nav", "ol", "p",
+          "search", "section", "summary", "ul");
+
+  private static final Set<String> IMPLIED_END_TAG_NAMES
+      = j8().setOf(
+          "dd", "dt", "li", "optgroup", "option", "p", "rb", "rp", "rt",
+          "rtc");
+
+  private static final Set<String> TABLE_STRUCTURE_START_TAG_NAMES
+      = j8().setOf(
+          "caption", "col", "colgroup", "tbody", "thead", "tfoot", "tr",
+          "td", "th");
+
+  /** Start tags the current HTML tree builder inserts and immediately pops. */
+  private static final Set<String> HTML_TREE_BUILDER_VOID_ELEMENT_NAMES
       = j8().setOf(
-          "table", "caption", "col", "colgroup", "tbody", "thead", "tfoot",
-          "tr", "td", "th", "template", "select", "frameset");
+          "area", "base", "basefont", "bgsound", "br", "embed", "hr",
+          "img", "input", "keygen", "link", "meta", "param", "source",
+          "track", "wbr");
 
   /** Start tags that "in body" ignores or merges rather than inserting. */
   private static final Set<String> IGNORED_HTML_START_TAG_NAMES
-      = j8().setOf("html", "body", "head", "frame");
+      = j8().setOf(
+          "html", "body", "head", "frame", "caption", "col", "colgroup",
+          "tbody", "thead", "tfoot", "tr", "td", "th");
 
   private static final Set<String> MATHML_TEXT_INTEGRATION_POINT_NAMES
       = j8().setOf("mi", "mo", "mn", "ms", "mtext");
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index 1c9d8e64..d9f011b9 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -1136,9 +1136,8 @@ public void closeTag(String elementName) {
 
   /**
    * Issue #461.  Browsers process the end tags of table structure with
-   * table scope, which no integration point bounds, so they close the
-   * foreign content around a cell along with the cell.  The tracker cannot
-   * see the table, so it fails closed for the rest of the input.
+   * table scope, which no integration point bounds, so they can close the
+   * foreign content around a cell along with the cell.
    */
   @Test
   void testTableScopeEndTagsEndForeignContent() {
@@ -1169,22 +1168,22 @@ void testTableScopeEndTagsEndForeignContent() {
         p.sanitize(
             "<table><tr><td><math><annotation-xml encoding=text/html><svg>"
             + "</table><object/>hidden"));
-    // The context stays unknown, so a later self-closing tag is not honored
-    // either.
+    // This table began below the tracked foreign root, so the context stays
+    // unknown after the end tag.
     assertEquals(
         "<svg><foreignObject><svg></svg></foreignObject></svg>"
         + "<svg><path>x</path></svg>",
         p.sanitize(
             "<table><tr><td><svg><foreignObject><svg></table><svg><path/>x"));
-    // Table structure inside an integration point implies elements the
-    // tracker does not see, so it fails closed at the start tag.
+    // Table structure inside an integration point follows the inherited
+    // table insertion mode, including implied elements and cell closing.
     assertEquals(
         "<svg><foreignObject><svg></svg></foreignObject></svg>",
         p.sanitize(
             "<svg><foreignObject><table><tr><td><svg></tbody>"
             + "<object/>hidden"));
     assertEquals(
-        "<svg><foreignObject><svg></svg></foreignObject></svg>",
+        "<svg><foreignObject><svg>hidden</svg></foreignObject></svg>",
         p.sanitize("<svg><foreignObject><select><svg><object/>hidden"));
     // An end tag searched in the default or list-item scope stops at the
     // integration point, so a browser ignores it and the dropped element
@@ -1195,6 +1194,107 @@ void testTableScopeEndTagsEndForeignContent() {
             "<ul><li><svg><foreignObject><svg></li><object/>shown"));
   }
 
+  /** Issue #461.  HTML start-tag rules can remove tracked stack entries. */
+  @Test
+  void testHtmlStartTagsUpdateForeignContentContext() {
+    PolicyFactory p = foreignContentPolicy();
+    String[] inputs = {
+        // image is rewritten to the void img element.
+        "<svg><foreignObject><image><math></svg><object/>hidden",
+        // command and isindex are ordinary elements in the current parser,
+        // despite legacy serialization tables classifying them as void.
+        "<svg><foreignObject><command><math></math></foreignObject>"
+        + "<object/>hidden",
+        "<svg><foreignObject><isindex><math></math></foreignObject>"
+        + "<object/>hidden",
+        // A block start closes p in button scope.
+        "<svg><foreignObject><p><div></div><math></svg><object/>hidden",
+        "<svg><foreignObject><p><hr><math></svg><object/>hidden",
+        // A heading start pops a heading current node.
+        "<svg><foreignObject><h2><h1></h1><math></svg><object/>hidden",
+        // A second button pops the first button and everything above it.
+        "<svg><foreignObject><button><div><button></button></div>"
+        + "<math></svg><object/>hidden",
+        // Duplicate formatting elements invoke the adoption agency rules.
+        "<svg><foreignObject><a><div><a></a></div><math></svg>"
+        + "<object/>hidden",
+        "<svg><foreignObject><nobr><div><nobr></nobr></div><math></svg>"
+        + "<object/>hidden",
+        // A non-formatting end tag can strand b in the active formatting
+        // list, from which a later start tag reconstructs it.
+        "<svg><foreignObject><div><b></div><math></math>"
+        + "</foreignObject><object/>hidden",
+        // An adoption-agency end tag removes only its own formatting entry;
+        // other formatting elements it pops can still be reconstructed.
+        "<svg><foreignObject><b><i></b><math></math></foreignObject>"
+        + "<object/>hidden",
+        // A duplicate form is ignored while the form pointer is non-null.
+        "<svg><foreignObject><form><div><form></form></div><math></svg>"
+        + "<object/>hidden",
+        // A form start closes p before inserting the form.
+        "<svg><foreignObject><p><form></form><math></svg><object/>hidden",
+        // A form end generates implied end tags before removing the form.
+        "<svg><foreignObject><form><option></form><image><math></svg>"
+        + "<object/>hidden",
+        // New list and description items close an earlier item.
+        "<svg><foreignObject><li><div><li></li></div><math></svg>"
+        + "<object/>hidden",
+        "<svg><foreignObject><dd><div><dt></dt></div><math></svg>"
+        + "<object/>hidden",
+        // A second option closes the current option even without a select.
+        "<svg><foreignObject><option><option></option><math></svg>"
+        + "<object/>hidden",
+        // input pops a select that is in scope under the current rules.
+        "<svg><foreignObject><select><input><math></svg><object/>hidden",
+        // In table mode a form is inserted and immediately popped.
+        "<table><svg><foreignObject><form><math></svg><object/>hidden",
+    };
+    for (String input : inputs) {
+      String output = p.sanitize(input);
+      assertFalse(output.contains("hidden"), input + " -> " + output);
+    }
+    // bgsound is still inserted and immediately popped by the tree builder,
+    // even though it is absent from the sanitizer's legacy void table.
+    assertEquals(
+        "<svg><foreignObject><math></math></foreignObject>hidden</svg>",
+        p.sanitize(
+            "<svg><foreignObject><bgsound><math></math></foreignObject>"
+            + "<object/>hidden"));
+  }
+
+  /** Issue #461.  {@code </form>} has a different effect in a template. */
+  @Test
+  void testFormEndTagInTemplatePopsThroughForm() {
+    assertEquals(
+        "<form><svg></svg></form>",
+        foreignContentPolicy().sanitize(
+            "<body><template><form><svg></form><object/>hidden"));
+  }
+
+  /** Well-formed HTML islands do not poison later foreign-content tracking. */
+  @Test
+  void testForeignContentContextRecoversAfterHtmlIsland() {
+    PolicyFactory p = foreignContentPolicy();
+    assertEquals(
+        "<svg><path></path><rect></rect></svg>"
+        + "<svg><path></path></svg>",
+        p.sanitize(
+            "<table><tr><td><svg><path/><rect/></svg></td></tr></table>"
+            + "<svg><path/></svg>"));
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>"
+        + "<svg><path></path><rect></rect></svg>",
+        p.sanitize(
+            "<svg><foreignObject><table></table></foreignObject></svg>"
+            + "<svg><path/><rect/></svg>"));
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>"
+        + "<svg><title></title><path></path></svg><p>after</p>",
+        p.sanitize(
+            "<svg><foreignObject><select></select></foreignObject></svg>"
+            + "<svg><title/><path/></svg><p>after</p>"));
+  }
+
   /**
    * Issue #461.  Under the HTML rules an end tag search stops at an element
    * in the special category, so the elements above it stay open, and the

From f9819fa92438a885bcd3350ba69a924f38044fa3 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Thu, 10 Sep 2026 10:41:32 -1000
Subject: [PATCH 3/4] Fix foreign-content tracker gaps found in review

Each case was verified against Chrome 152 with <object/>hidden as the
oracle: an HTML object owning the text means the browser is in HTML
content and the sanitizer must not honor the self-closing flag.

- An xmp start tag closes an open p, like pre and listing.
- A table start tag after an open p fails closed, since only a
  no-quirks document closes the p and the embedding document's mode
  is unknown.
- Only the first of duplicate type attributes decides whether an input
  is hidden, as the tokenizer drops the later ones.
- Untracked cells, captions, sections and nested tables are followed
  with a bounded stack, so a cell or section end tag that names
  something else is ignored as browsers ignore it, and well-formed
  nested tables and captions no longer poison later SVG.
- A search element makes the context unknown when an end-tag or
  list-item walk reaches it, since the specification puts it in the
  special category and current Chrome does not.
- A self-closing svg or math root still closes itself inside a tracked
  empty table when the tracker gives up.

Issue #461.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RajvH16nNkgw9TJS6nEpTT
---
 change_log.md                                 |   8 +
 .../java/org/owasp/html/HtmlSanitizer.java    | 146 +++++++++++----
 .../org/owasp/html/HtmlSanitizerTest.java     | 172 ++++++++++++++++++
 3 files changed, 291 insertions(+), 35 deletions(-)

diff --git a/change_log.md b/change_log.md
index 0ae3de98..48265c86 100644
--- a/change_log.md
+++ b/change_log.md
@@ -13,6 +13,14 @@ Most recent at top.
       `<math/>` close themselves.  Well-formed select and empty-table HTML
       islands no longer make later SVG unnecessarily use that fallback.
       Issue #461.
+    * The same tracker now closes p for `xmp`, honors only the first of
+      duplicate `type` attributes on `input`, fails closed for `table` after
+      an open p (whose fate depends on quirks mode) and for `search` (which
+      the specification and Chrome categorize differently), and follows
+      untracked cells, captions, sections and nested tables so that a
+      mismatched cell or section end tag is ignored as browsers ignore it.
+      Well-formed nested tables and captions no longer make later SVG use
+      the fallback.  Issue #461.
     * Self-closing SVG and MathML handling now follows the browser's current
       tree-construction context through HTML integration points, foreign
       content breakout tags, mismatched foreign end tags, and the end tags
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
index ef291b3e..5bfc64ce 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -258,8 +258,14 @@ private static final class ForeignContentContext {
     /** The HTML mode that remains in force while foreign rules run. */
     private HtmlInsertionMode htmlInsertionMode = HtmlInsertionMode.IN_BODY;
 
-    /** Whether an untracked table is known to be in table scope. */
-    private boolean untrackedTableInScope;
+    /** Bound the memory spent on untracked tables that never close. */
+    private static final int MAX_UNTRACKED_TABLES = 32;
+
+    /**
+     * The tables open below the tracked region, innermost last.  Each is in
+     * table scope, since a template makes the context unknown.
+     */
+    private final List<UntrackedTable> untrackedTables = new ArrayList<>();
 
     /**
      * True once the browser's context can no longer be derived from the
@@ -410,6 +416,10 @@ && currentElement() == simpleTable) {
         if (anyOther) {
           // "Any other end tag" stops at any element in the special
           // category.
+          if (AMBIGUOUSLY_SPECIAL_HTML_ELEMENT_NAMES.contains(openName)) {
+            becomeUnknown();
+            return;
+          }
           if (SPECIAL_HTML_ELEMENT_NAMES.contains(openName)) { return; }
           continue;
         }
@@ -443,7 +453,7 @@ private boolean processHtmlStartTag(
         // foster-parenting elements.  Keep the empty-table case exact and
         // fail closed for the rest.
         becomeUnknown();
-        return false;
+        return selfClosing && isForeignContentRoot(elementName);
       }
 
       Namespace namespace;
@@ -454,10 +464,7 @@ private boolean processHtmlStartTag(
       } else {
         if (openElements.isEmpty()) {
           trackUntrackedHtmlStartTag(elementName);
-        }
-        if (htmlInsertionMode == HtmlInsertionMode.UNKNOWN) {
-          becomeUnknown();
-          return false;
+          if (unknown) { return false; }
         }
         if (UNMODELED_CONTEXT_CHANGING_START_TAG_NAMES.contains(elementName)) {
           becomeUnknown();
@@ -487,7 +494,8 @@ private boolean processHtmlStartTag(
         if (P_CLOSING_START_TAG_NAMES.contains(elementName)
             || "pre".equals(elementName)
             || "listing".equals(elementName)
-            || "plaintext".equals(elementName)) {
+            || "plaintext".equals(elementName)
+            || "xmp".equals(elementName)) {
           if (!closePIfInButtonScope()) { return false; }
         } else if (isHeadingName(elementName)) {
           if (!closePIfInButtonScope()) { return false; }
@@ -571,7 +579,12 @@ && hasHiddenInputType(attrs)) {
             becomeUnknown();
             return false;
           }
-          if (!closePIfInButtonScope()) { return false; }
+          if (findHtmlElementInDefaultScope("p", true) >= 0) {
+            // Only a no-quirks document closes the p, and the sanitizer
+            // cannot know the mode of the document that embeds its output.
+            becomeUnknown();
+            return false;
+          }
           OpenElement table = new OpenElement(
               elementName, Namespace.HTML, attrs);
           push(table);
@@ -598,39 +611,82 @@ && hasHiddenInputType(attrs)) {
       return selfClosing;
     }
 
+    private @Nullable UntrackedTable currentUntrackedTable() {
+      int size = untrackedTables.size();
+      return size != 0 ? untrackedTables.get(size - 1) : null;
+    }
+
+    /** Derives the HTML insertion mode from the innermost untracked table. */
+    private void syncInsertionMode() {
+      UntrackedTable table = currentUntrackedTable();
+      if (table == null) {
+        htmlInsertionMode = HtmlInsertionMode.IN_BODY;
+      } else if (table.cellName != null) {
+        // The cell and caption modes hand everything else to the in-body
+        // rules, but hand table structure to the table rules.
+        htmlInsertionMode = HtmlInsertionMode.IN_CELL;
+      } else {
+        htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+      }
+    }
+
     private void trackUntrackedHtmlStartTag(String elementName) {
+      UntrackedTable table = currentUntrackedTable();
       if ("table".equals(elementName)) {
-        if (!untrackedTableInScope) {
-          untrackedTableInScope = true;
-          htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
-        } else if (htmlInsertionMode == HtmlInsertionMode.IN_CELL) {
-          // This is a nested table; its eventual end tag needs a mode stack.
-          htmlInsertionMode = HtmlInsertionMode.UNKNOWN;
+        if (table != null && table.cellName == null) {
+          // The table modes pop the open table before reprocessing the
+          // token; a cell or caption nests the new table instead.
+          untrackedTables.remove(untrackedTables.size() - 1);
+        }
+        if (untrackedTables.size() == MAX_UNTRACKED_TABLES) {
+          becomeUnknown();
+          return;
         }
+        untrackedTables.add(new UntrackedTable());
+      } else if (table == null) {
         return;
-      }
-      if (!untrackedTableInScope) { return; }
-      if ("td".equals(elementName) || "th".equals(elementName)) {
-        htmlInsertionMode = HtmlInsertionMode.IN_CELL;
+      } else if ("td".equals(elementName) || "th".equals(elementName)) {
+        table.cellName = elementName;
+        if (table.sectionName == null) { table.sectionName = "tbody"; }
       } else if ("caption".equals(elementName)) {
-        // Caption uses body rules for most tokens, but not for table-family
-        // starts, so keep the distinction conservative.
-        htmlInsertionMode = HtmlInsertionMode.UNKNOWN;
-      } else if (TABLE_STRUCTURE_START_TAG_NAMES.contains(elementName)) {
-        htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
+        table.cellName = elementName;
+        table.sectionName = null;
+      } else if ("tr".equals(elementName)) {
+        table.cellName = null;
+        if (table.sectionName == null) { table.sectionName = "tbody"; }
+      } else if ("tbody".equals(elementName) || "thead".equals(elementName)
+                 || "tfoot".equals(elementName)) {
+        table.cellName = null;
+        table.sectionName = elementName;
+      } else if ("col".equals(elementName) || "colgroup".equals(elementName)) {
+        table.cellName = null;
+        table.sectionName = null;
       }
+      syncInsertionMode();
     }
 
     private void trackUntrackedHtmlEndTag(String elementName) {
-      if (!untrackedTableInScope) { return; }
+      UntrackedTable table = currentUntrackedTable();
+      if (table == null) { return; }
       if ("table".equals(elementName)) {
-        if (htmlInsertionMode != HtmlInsertionMode.UNKNOWN) {
-          untrackedTableInScope = false;
-          htmlInsertionMode = HtmlInsertionMode.IN_BODY;
+        untrackedTables.remove(untrackedTables.size() - 1);
+      } else if ("td".equals(elementName) || "th".equals(elementName)
+                 || "caption".equals(elementName)) {
+        // Ignored unless it names the open cell or caption.
+        if (elementName.equals(table.cellName)) { table.cellName = null; }
+      } else if ("tr".equals(elementName)) {
+        // A caption ignores it; a cell closes along with the row.
+        if (!"caption".equals(table.cellName)) { table.cellName = null; }
+      } else if ("tbody".equals(elementName) || "thead".equals(elementName)
+                 || "tfoot".equals(elementName)) {
+        // A caption ignores it, and so does a cell in another section.
+        if (!"caption".equals(table.cellName)
+            && elementName.equals(table.sectionName)) {
+          table.cellName = null;
+          table.sectionName = null;
         }
-      } else if (TABLE_SCOPED_ELEMENT_NAMES.contains(elementName)) {
-        htmlInsertionMode = HtmlInsertionMode.IN_TABLE;
       }
+      syncInsertionMode();
     }
 
     private void processFormStartTag(List<String> attrs) {
@@ -661,6 +717,12 @@ private boolean closeListOrDescriptionItemForStart(boolean listItem) {
                     || "dt".equals(open.elementName))) {
           return popTrackedElementsFrom(i, false, null);
         }
+        if (open.namespace == Namespace.HTML
+            && AMBIGUOUSLY_SPECIAL_HTML_ELEMENT_NAMES.contains(
+                open.elementName)) {
+          becomeUnknown();
+          return false;
+        }
         if (isSpecial(open)
             && !isHtmlElement(open, "address")
             && !isHtmlElement(open, "div")
@@ -760,9 +822,9 @@ private static boolean isSpecial(OpenElement open) {
 
     private static boolean hasHiddenInputType(List<String> attrs) {
       for (int i = 0; i + 1 < attrs.size(); i += 2) {
-        if ("type".equals(attrs.get(i))
-            && asciiEqualsIgnoreCase("hidden", attrs.get(i + 1))) {
-          return true;
+        if ("type".equals(attrs.get(i))) {
+          // The tokenizer drops all but the first of duplicate attributes.
+          return asciiEqualsIgnoreCase("hidden", attrs.get(i + 1));
         }
       }
       return false;
@@ -773,7 +835,7 @@ private void becomeUnknown() {
       formElementPointerSet = false;
       trackedFormElement = null;
       simpleTable = null;
-      untrackedTableInScope = false;
+      untrackedTables.clear();
       unknown = true;
     }
 
@@ -823,7 +885,6 @@ private enum HtmlInsertionMode {
     IN_BODY,
     IN_TABLE,
     IN_CELL,
-    UNKNOWN,
   }
 
   private enum Namespace {
@@ -855,6 +916,14 @@ private static final class OpenElement {
     }
   }
 
+  /** A table open below the tracked region, and the part of it being filled. */
+  private static final class UntrackedTable {
+    /** td, th or caption while one is open. */
+    @Nullable String cellName;
+    /** tbody, thead or tfoot while one is open. */
+    @Nullable String sectionName;
+  }
+
   private static boolean isForeignContentRoot(String canonElementName) {
     return "svg".equals(canonElementName) || "math".equals(canonElementName);
   }
@@ -972,6 +1041,13 @@ private static boolean isHeadingName(String canonElementName) {
           "tfoot", "th", "thead", "title", "tr", "track", "ul", "wbr",
           "xmp");
 
+  /**
+   * Elements the specification puts in the special category but current
+   * Chrome does not, so a walk that reaches one has an uncertain outcome.
+   */
+  private static final Set<String> AMBIGUOUSLY_SPECIAL_HTML_ELEMENT_NAMES
+      = j8().setOf("search");
+
   /** Start tags whose HTML stack effect this bounded tracker cannot derive. */
   private static final Set<String> UNMODELED_CONTEXT_CHANGING_START_TAG_NAMES
       = j8().setOf("template", "frameset");
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index d9f011b9..7f54275e 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -1382,6 +1382,178 @@ void testStrayEndTagLeavesForeignContentContextUnknown() {
         p.sanitize("<svg><g></foo></g></svg><svg/>x"));
   }
 
+  /**
+   * Issue #461.  More start-tag rules that change the tracked stack, and
+   * those whose outcome the sanitizer cannot know.
+   */
+  @Test
+  void testMoreHtmlStartTagRulesInForeignContentContext() {
+    PolicyFactory p = foreignContentPolicy();
+    // xmp closes a p in button scope, as pre and listing do.
+    assertEquals(
+        "<svg><foreignObject><p></p><math></math></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><p><xmp></xmp><math></svg><object/>hidden"));
+    assertEquals(
+        "<svg><foreignObject><p></p></foreignObject></svg>"
+        + "<svg><path></path></svg>",
+        p.sanitize(
+            "<svg><foreignObject><p><xmp></xmp></foreignObject></svg>"
+            + "<svg><path/></p></foreignObject><object/>hidden"));
+    // Whether a table start closes an open p depends on the quirks mode of
+    // the document that embeds the output, so the context fails closed.
+    assertEquals(
+        "<svg><foreignObject><p></p></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><p><table></table></foreignObject>"
+            + "<object/>hidden"));
+    // The tokenizer keeps only the first of duplicate attributes, so this
+    // input is not hidden: in table mode it still pops the open select.
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>",
+        p.sanitize(
+            "<table><svg><foreignObject><select><input type=text type=hidden>"
+            + "</foreignObject></svg></select></foreignObject>"
+            + "<object/>hidden"));
+    // A table inside a cell's foreign content is tracked exactly and hands
+    // the cell's in-body rules back when it closes.
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>",
+        p.sanitize(
+            "<table><tr><td><svg><foreignObject><table></table>"
+            + "<object/>hidden"));
+    // A self-closing root closes itself even where the tracker gives up.
+    assertEquals(
+        "<svg><foreignObject><svg></svg>x</foreignObject></svg>",
+        p.sanitize("<svg><foreignObject><table><svg/>x"));
+  }
+
+  /**
+   * Issue #461.  The specification puts search in the special category but
+   * Chrome does not, so an end-tag or list-item walk that reaches one has
+   * no single right answer, and the context fails closed.
+   */
+  @Test
+  void testSearchElementCategoryIsNotReliedOn() {
+    PolicyFactory p = foreignContentPolicy();
+    assertEquals(
+        "<svg><foreignObject><cite></cite></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><cite><search><span></cite></foreignObject>"
+            + "</svg></span></search></cite></foreignObject><object/>hidden"));
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><li><search><li></li></foreignObject></svg>"
+            + "</search></li></foreignObject><object/>hidden"));
+  }
+
+  /**
+   * Issue #461.  The insertion mode inherited from an untracked table
+   * depends on which cell, caption or section is open, and browsers ignore
+   * the end tags that name something else.
+   */
+  @Test
+  void testUntrackedTableEndTagsMustNameTheOpenPart() {
+    PolicyFactory p = foreignContentPolicy();
+    String svgForm
+        = "<svg><foreignObject><form></foreignObject><object/>hidden";
+    // Inside a cell or caption the in-body rules insert the form, which
+    // stays open and keeps the object's fallback text hidden.
+    String hidden = "<svg><foreignObject><form></form></foreignObject></svg>";
+    for (String context : new String[] {
+             "<table><tr><th></td>", "<table><tr><td></th>",
+             "<table><thead><tr><td></tbody>", "<table><tr><td></tfoot>",
+             "<table><tr><td></caption>", "<table><caption></tr>",
+             "<table><caption></tbody>", "<table><caption></td>",
+             "<table><caption>", "<table><tr><td><table></table>",
+             "<table><tr><td><table><tr><td></table>",
+             "<table><tr><td><table><tr><td></td></tr></table>" }) {
+      assertEquals(hidden, p.sanitize(context + svgForm), context);
+    }
+    // Back in the table modes the form is inserted and popped at once, so
+    // the foreignObject closes and the object is foreign.
+    String shown
+        = "<svg><foreignObject><form></form></foreignObject>hidden</svg>";
+    for (String context : new String[] {
+             "<table><tr><td></td>", "<table><tr><td></tr>",
+             "<table><thead><tr><td></thead>", "<table><caption></caption>",
+             "<table><tr><td><table></table></td>",
+             "<table><tr><td><table><tr><td></td></tr></table></td>" }) {
+      assertEquals(shown, p.sanitize(context + svgForm), context);
+    }
+    // Table structure inside a caption closes the caption and everything
+    // above it, which the tracker does not follow.
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>",
+        p.sanitize(
+            "<table><caption><svg><foreignObject><td></foreignObject>"
+            + "<object/>hidden"));
+  }
+
+  /** Well-formed nested tables and captions do not poison later SVG. */
+  @Test
+  void testForeignContentContextRecoversAfterNestedTables() {
+    PolicyFactory p = foreignContentPolicy();
+    assertEquals(
+        "x<svg><path></path><rect></rect></svg>",
+        p.sanitize(
+            "<table><tr><td><table><tr><td>x</td></tr></table></td></tr>"
+            + "</table><svg><path/><rect/></svg>"));
+    assertEquals(
+        "x<svg><path></path><rect></rect></svg>",
+        p.sanitize(
+            "<table><caption>x</caption></table><svg><path/><rect/></svg>"));
+    assertEquals(
+        "<svg><path></path><rect></rect></svg>",
+        p.sanitize(
+            "<table><caption><table></table></caption></table>"
+            + "<svg><path/><rect/></svg>"));
+  }
+
+  /**
+   * Issue #461.  The modeled transitions are followed exactly rather than
+   * by failing closed: a self-closing tag is still honored in later SVG.
+   */
+  @Test
+  void testModeledTransitionsKeepHonoringSelfClosingTags() {
+    PolicyFactory p = foreignContentPolicy();
+    String[] inputs = {
+        "<svg><foreignObject><p><div></div><math></svg><svg><path/>x",
+        "<svg><foreignObject><h2><h1></h1><math></svg><svg><path/>x",
+        "<svg><foreignObject><button><div><button></button></div><math>"
+        + "</svg><svg><path/>x",
+        "<svg><foreignObject><form><div><form></form></div><math></svg>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><li><div><li></li></div><math></svg>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><dd><div><dt></dt></div><math></svg>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><option><option></option><math></svg>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><select><input><math></svg><svg><path/>x",
+        "<svg><foreignObject><p><hr><math></svg><svg><path/>x",
+        "<svg><foreignObject><p><xmp></xmp><math></svg><svg><path/>x",
+        "<svg><foreignObject><image><math></svg><svg><path/>x",
+        "<svg><foreignObject><form><option></form><image><math></svg>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><h2><svg></h1><svg><path/>x",
+        "<svg><foreignObject><form><cite></form></foreignObject>"
+        + "<svg><path/>x",
+        "<svg><foreignObject><cite><div></cite></foreignObject>"
+        + "<svg><path/>x",
+        "<table><svg><foreignObject><form><math></svg><svg><path/>x",
+        "<table><tr><th></td><svg><foreignObject><form></foreignObject>"
+        + "</svg><svg><path/>x",
+        "<table><tr><td><table><tr><td>x</td></tr></table></td></tr></table>"
+        + "<svg><foreignObject><form></foreignObject></svg><svg><path/>x",
+    };
+    for (String input : inputs) {
+      String output = p.sanitize(input);
+      assertTrue(output.contains("<path></path>x"), input + " -> " + output);
+    }
+  }
+
   /** The bounded context tracker falls back to suppressing dropped content. */
   @Test
   void testDeepForeignContentContextFailsClosed() {

From 0ac7b2972ead9897a341396d72a1eb2f9171b9e3 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Thu, 10 Sep 2026 12:45:17 -1000
Subject: [PATCH 4/4] Fail closed for an open dialog like search in foreign
 content

dialog is in the WHATWG parsing algorithm's special category but absent
from Chrome's special-node set, the same split the review follow-up
already handled for search. A stack walk that reached an open dialog
followed Chrome alone, so a later self-closing <object/> (or a raw-text
element such as <title/>) was honored, exposing text that a
spec-compliant or Firefox parser keeps inside the HTML element.

Add dialog to the special and ambiguously-special sets so the three
affected walks fail closed: the "any other end tag" scan, the list-item
start scan, and the adoption agency's furthest-block search. Add a
regression test covering each walk; every case leaks the text on the
prior branch head and is suppressed now. A modeled dialog block
transition still honors a later self-closing tag.

Issue #461.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015c2SFXiJJvU9JfWBCtGdNo
---
 change_log.md                                 |  5 +++
 .../java/org/owasp/html/HtmlSanitizer.java    | 11 ++++---
 .../org/owasp/html/HtmlSanitizerTest.java     | 31 +++++++++++++++++++
 3 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/change_log.md b/change_log.md
index 48265c86..c890f295 100644
--- a/change_log.md
+++ b/change_log.md
@@ -21,6 +21,11 @@ Most recent at top.
       mismatched cell or section end tag is ignored as browsers ignore it.
       Well-formed nested tables and captions no longer make later SVG use
       the fallback.  Issue #461.
+    * The same tracker now also fails closed when a walk reaches an open
+      `dialog`, which the specification and Chrome categorize differently in
+      the special category, exactly as it already did for `search`.  Without
+      this a later self-closing `<object/>` was honored, exposing text a
+      spec-compliant parser keeps inside the HTML `object`.  Issue #461.
     * Self-closing SVG and MathML handling now follows the browser's current
       tree-construction context through HTML integration points, foreign
       content breakout tags, mismatched foreign end tags, and the end tags
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
index 5bfc64ce..54e3f700 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlSanitizer.java
@@ -1029,9 +1029,10 @@ private static boolean isHeadingName(String canonElementName) {
       = j8().setOf(
           "address", "applet", "area", "article", "aside", "base",
           "basefont", "bgsound", "blockquote", "body", "br", "button",
-          "caption", "center", "col", "colgroup", "dd", "details", "dir",
-          "div", "dl", "dt", "embed", "fieldset", "figcaption", "figure",
-          "footer", "form", "frame", "frameset", "h1", "h2", "h3", "h4",
+          "caption", "center", "col", "colgroup", "dd", "details",
+          "dialog", "dir", "div", "dl", "dt", "embed", "fieldset",
+          "figcaption", "figure", "footer", "form", "frame", "frameset",
+          "h1", "h2", "h3", "h4",
           "h5", "h6", "head", "header", "hgroup", "hr", "html", "iframe",
           "img", "input", "keygen", "li", "link", "listing", "main",
           "marquee", "menu", "meta", "nav", "noembed", "noframes",
@@ -1044,9 +1045,11 @@ private static boolean isHeadingName(String canonElementName) {
   /**
    * Elements the specification puts in the special category but current
    * Chrome does not, so a walk that reaches one has an uncertain outcome.
+   * {@code dialog} and {@code search} are both special in the WHATWG parsing
+   * algorithm but absent from Chrome's special-node set.
    */
   private static final Set<String> AMBIGUOUSLY_SPECIAL_HTML_ELEMENT_NAMES
-      = j8().setOf("search");
+      = j8().setOf("dialog", "search");
 
   /** Start tags whose HTML stack effect this bounded tracker cannot derive. */
   private static final Set<String> UNMODELED_CONTEXT_CHANGING_START_TAG_NAMES
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index 7f54275e..688286be 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -1448,6 +1448,37 @@ void testSearchElementCategoryIsNotReliedOn() {
             + "</search></li></foreignObject><object/>hidden"));
   }
 
+  /**
+   * Issue #461.  Like {@code search}, {@code dialog} is in the special
+   * category of the WHATWG parsing algorithm but not in Chrome's special-node
+   * set, so a walk that reaches an open {@code dialog} has no single right
+   * answer across browsers and the context must fail closed.  Without this a
+   * following {@code <object/>} was honored as self-closing, exposing text
+   * that a spec-compliant parser keeps inside the HTML {@code object}.
+   */
+  @Test
+  void testDialogElementCategoryIsNotReliedOn() {
+    PolicyFactory p = foreignContentPolicy();
+    // "Any other end tag" (</cite>) walks past the open dialog.
+    assertEquals(
+        "<svg><foreignObject><cite></cite></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><cite><dialog></cite></foreignObject>"
+            + "<object/>hidden"));
+    // A list-item start (<li>) walks past the open dialog.
+    assertEquals(
+        "<svg><foreignObject></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><li><dialog><li></li></foreignObject>"
+            + "<object/>hidden"));
+    // The adoption agency's furthest-block search (</b>) reaches the dialog.
+    assertEquals(
+        "<svg><foreignObject><b><svg></svg></b></foreignObject></svg>",
+        p.sanitize(
+            "<svg><foreignObject><b><dialog><svg></b></foreignObject>"
+            + "<object/>hidden"));
+  }
+
   /**
    * Issue #461.  The insertion mode inherited from an untracked table
    * depends on which cell, caption or section is open, and browsers ignore