fixup! fix: Escapes </noscript in raw text when scripting enabled

Author: SkyZeroZx

lib/NodeUtils.js

@@ -29,6 +29,7 @@ var hasRawContent = {
   XMP: true,
   IFRAME: true,
   NOEMBED: true,
+  NOSCRIPT: true,
   NOFRAMES: true,
   PLAINTEXT: true
 };
@@ -195,8 +196,7 @@ function serializeOne(kid, parent) {
         // If an element can have raw content, this content may
         // potentially require escaping to avoid XSS.
         var upperTag = tagname.toUpperCase();
-        if (hasRawContent[upperTag] ||
-            (upperTag === 'NOSCRIPT' && kid.ownerDocument._scripting_enabled)) {
+        if (hasRawContent[upperTag]) {
           ss = escapeMatchingClosingTag(ss, tagname);
         }
         if (html && extraNewLine[tagname] && ss.charAt(0)==='\n') s += '\n';
@@ -214,8 +214,7 @@ function serializeOne(kid, parent) {
       else
         parenttag = '';
 
-      if (hasRawContent[parenttag] ||
-          (parenttag==='NOSCRIPT' && parent.ownerDocument._scripting_enabled)) {
+      if (hasRawContent[parenttag]) {
         s += kid.data;
       } else {
         s += escape(kid.data);

test/xss.js

@@ -180,13 +180,11 @@ exports.styleMatchingClosingTagSkipsUnclosedCommentedContent = function () {
 };
 
 exports.noscriptMatchingClosingTagInRawText = function () {
-  // Use a parsed document so `_scripting_enabled` is true, matching how
-  // Angular SSR / platform-server uses domino. With scripting enabled,
   // <noscript> is a raw-text element on serialization and its text data
   // must have any `</noscript` closing-tag prefix escaped, otherwise an
   // attacker-controlled text payload can break out and inject a live
   // <script> sibling in the receiving browser.
-  const document = domino.createDocument('<!doctype html><html><body></body></html>');
+  const document = domino.createDocument('');
   const noscript = document.createElement('noscript');
   noscript.textContent = 'abc</noscript><script>alert(1)</script>';
   document.body.appendChild(noscript);