symfony · nicolas-grekas · May 6, 2022 · May 5, 2022
diff --git a/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerAllTest.php b/src/Symfony/Component/HtmlSanitizer/Tests/HtmlSanitizerAllTest.php
@@ -237,16 +237,21 @@ public function provideSanitizeBody()
            ],
            [
                '<BODY BACKGROUND="javascript:alert(\'XSS\')">',
-                '<body />',
+                '<body></body>',
            ],
            [
                '<BGSOUND SRC="javascript:alert(\'XSS\');">',
-                '<bgsound />',
+                '<bgsound></bgsound>',
            ],
            [
                '<BR SIZE="&{alert(\'XSS\')}">',
                '<br size="&amp;{alert(&#039;XSS&#039;)}" />',
            ],
+            [
+                '<BR></br>',
+                '<br /><br />',
+            ],
+
            [
                '<OBJECT TYPE="text/x-scriptlet" DATA="http://xss.rocks/scriptlet.html"></OBJECT>',
                '',
@@ -445,6 +450,11 @@ public function provideSanitizeBody()
                '<i>Lorem ipsum</i>',
                '<i>Lorem ipsum</i>',
            ],
+            [
+                '<i></i>',
+                '<i></i>',
+            ],
+
            [
                '<li>Lorem ipsum</li>',
                '<li>Lorem ipsum</li>',

diff --git a/src/Symfony/Component/HtmlSanitizer/Visitor/Node/Node.php b/src/Symfony/Component/HtmlSanitizer/Visitor/Node/Node.php
@@ -20,6 +20,25 @@
 */
 final class Node implements NodeInterface
 {
+    // HTML5 elements which are self-closing
+    private const VOID_ELEMENTS = [
+        'area' => true,
+        'base' => true,
+        'br' => true,
+        'col' => true,
+        'embed' => true,
+        'hr' => true,
+        'img' => true,
+        'input' => true,
+        'keygen' => true,
+        'link' => true,
+        'meta' => true,
+        'param' => true,
+        'source' => true,
+        'track' => true,
+        'wbr' => true,
+    ];
+
    private NodeInterface $parent;
    private string $tagName;
    private array $attributes = [];
@@ -56,7 +75,7 @@ public function addChild(NodeInterface $node): void

    public function render(): string
    {
-        if (!$this->children) {
+        if (isset(self::VOID_ELEMENTS[$this->tagName])) {
            return '<'.$this->tagName.$this->renderAttributes().' />';
        }