fix(sanitization): match onload case- and space-insensitively

[chuhuangvio-itch]

What is the current behavior?

sanitizeDOMString (core/src/utils/sanitization/index.ts) blocks untrusted HTML containing onload= before it reaches innerHTML, because onload can fire synchronously while the string is being parsed into the working document fragment — before the later attribute-allowlist pass runs. The check is a plain lowercase substring match (untrustedString.includes('onload=')), so it misses onLoad=, ONLOAD=, or onload = (whitespace before =) even though HTML parses all of those as the same event handler.

What is the new behavior?

• Replaced the substring check with a case-insensitive regex that also tolerates whitespace around = (/onload\s*=/i), matching how HTML actually parses attribute names.
• Added a test covering the case and whitespace variants.

Does this introduce a breaking change?

• Yes
• No

Other information

sanitizeDOMString is used by ion-toast, ion-loading, the ion-alert message, ion-refresher-content, and ion-infinite-scroll-content to sanitize developer-supplied HTML strings that may embed end-user input (e.g. another user's display name rendered in a toast/alert). This closes a gap where a payload like <svg onLoad=...> could bypass the intended guard and reach innerHTML unfiltered.

I didn't find an existing SECURITY.md or private vulnerability reporting channel enabled on this repo, so opening this directly as a PR with the fix rather than filing a separate public issue describing the bypass.

[vercel]

@chuhuangvio-itch is attempting to deploy a commit to the Ionic Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ionic-framework	Ready	Preview	Sep 2, 2026 6:54pm UTC

[ShaneK]

Hey @chuhuangvio-itch! Thanks for catching this, the fix looks right and we're going to merge it.

For next time, we do have a security policy with a private reporting channel, it's just inherited from the org so it shows up on our Security tab rather than as a SECURITY.md in the repo. Reports go to security@ionic.io.

I pushed a commit onto your branch with a few changes. The test payloads are nested now (<svg><svg onLoad=...>) because a top-level <svg onload> never actually fires, in Blink only a non-outermost one dispatches its load event during the innerHTML parse, so the original assertions weren't hitting the real vector. I also added a printIonWarning on the discard path since returning '' silently blanks the whole toast or alert message, and the broad match catches benign content like href="/docs?onload=1" too. The old comment said the event fired when appending to the fragment, which isn't quite the mechanism, so I reworded that as well.

Edit: This fix has been released in v9.0.2!