fix: Fixed an off-by-one with the nesting counter causing over-sanitization

Author: cure53

dist/purify.cjs.js

@@ -516,7 +516,7 @@ function createDOMPurify() {
   let CONFIG = null;
 
   /* Specify the maximum element nesting depth to prevent mXSS */
-  const MAX_NESTING_DEPTH = 511;
+  const MAX_NESTING_DEPTH = 512;
 
   /* Ideally, do not touch anything below this line */
   /* ______________________________________________ */
@@ -1388,7 +1388,7 @@ function createDOMPurify() {
       }
 
       /* Remove an element if nested too deeply to avoid mXSS */
-      if (depth >= MAX_NESTING_DEPTH) {
+      if (depth > MAX_NESTING_DEPTH) {
         _forceRemove(currentNode);
       }
 

dist/purify.cjs.js.map

@@ -389,7 +389,7 @@ function createDOMPurify(window = getGlobal()) {
   let CONFIG = null;
 
   /* Specify the maximum element nesting depth to prevent mXSS */
-  const MAX_NESTING_DEPTH = 511;
+  const MAX_NESTING_DEPTH = 512;
 
   /* Ideally, do not touch anything below this line */
   /* ______________________________________________ */
@@ -1511,7 +1511,7 @@ function createDOMPurify(window = getGlobal()) {
       }
 
       /* Remove an element if nested too deeply to avoid mXSS */
-      if (depth >= MAX_NESTING_DEPTH) {
+      if (depth > MAX_NESTING_DEPTH) {
         _forceRemove(currentNode);
       }