From 33359ab36cacb7bf14b382399b2583ced5d00897 Mon Sep 17 00:00:00 2001
From: phillipc <phillipc@gmx.de>
Date: Tue, 21 Apr 2026 19:29:22 +0200
Subject: [PATCH 1/2] Fix makeTemplateNode bypassing HTML sanitization

Route <script> template content through validateHTMLInput in
makeTemplateNode so templateSizeLimit, allowScriptTagsInTemplates,
and sanitizeHtmlTemplate checks apply.
---
 packages/binding.foreach/src/foreach.ts | 12 ++++++++++--
 packages/utils/src/dom/html.ts          |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/packages/binding.foreach/src/foreach.ts b/packages/binding.foreach/src/foreach.ts
index 72ef35ce6..1552dd722 100644
--- a/packages/binding.foreach/src/foreach.ts
+++ b/packages/binding.foreach/src/foreach.ts
@@ -5,7 +5,15 @@
 // Employing sound techniques to make a faster Knockout foreach binding.
 // --------
 
-import { arrayForEach, cleanNode, options, virtualElements, domData, domNodeIsContainedBy } from '@tko/utils'
+import {
+  arrayForEach,
+  cleanNode,
+  options,
+  virtualElements,
+  domData,
+  domNodeIsContainedBy,
+  validateHTMLInput
+} from '@tko/utils'
 
 import { isObservable, unwrap, observable } from '@tko/observable'
 
@@ -57,7 +65,7 @@ function makeTemplateNode(sourceNode) {
     parentNode = sourceNode.content
   } else if (sourceNode.tagName === 'SCRIPT') {
     parentNode = document.createElement('div')
-    parentNode.innerHTML = sourceNode.text
+    parentNode.innerHTML = validateHTMLInput(sourceNode.text)
   } else {
     // Anything else e.g. <div>
     parentNode = sourceNode
diff --git a/packages/utils/src/dom/html.ts b/packages/utils/src/dom/html.ts
index 761c34036..7f3636d83 100644
--- a/packages/utils/src/dom/html.ts
+++ b/packages/utils/src/dom/html.ts
@@ -68,7 +68,7 @@ export function parseHtmlFragment(html: string, documentContext?: Document): Nod
 }
 
 const scriptTagPattern = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/i
-function validateHTMLInput(html: string): string {
+export function validateHTMLInput(html: string): string {
   if (!html) return ''
 
   if (options.templateSizeLimit > 0 && html.length > options.templateSizeLimit) {

From 54a1887076c7ae7eaf2befcc3c198b827ece85b6 Mon Sep 17 00:00:00 2001
From: phillipc <phillipc@gmx.de>
Date: Tue, 5 May 2026 20:23:51 +0200
Subject: [PATCH 2/2] Fix HTML sanitization for <script> templates in foreach
 binding

---
 ...ix-foreach-script-template-sanitization.md |  8 +++
 packages/binding.foreach/spec/eachBehavior.ts | 61 +++++++++++++++++++
 packages/binding.foreach/src/foreach.ts       |  7 +--
 packages/utils/src/dom/html.ts                |  2 +-
 4 files changed, 72 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/fix-foreach-script-template-sanitization.md

diff --git a/.changeset/fix-foreach-script-template-sanitization.md b/.changeset/fix-foreach-script-template-sanitization.md
new file mode 100644
index 000000000..a883fa74b
--- /dev/null
+++ b/.changeset/fix-foreach-script-template-sanitization.md
@@ -0,0 +1,8 @@
+---
+'@tko/binding.foreach': patch
+---
+
+Fix `makeTemplateNode` bypassing HTML sanitization for `<script>` foreach templates. Script-template text now
+goes through the existing HTML template parsing safeguards, so oversized templates, disallowed nested `<script>`
+markup, and `sanitizeHtmlTemplate` apply consistently. Existing apps that intentionally embed `<script>` markup
+in foreach script templates should set `allowScriptTagsInTemplates: true`.
diff --git a/packages/binding.foreach/spec/eachBehavior.ts b/packages/binding.foreach/spec/eachBehavior.ts
index 77e2e04ef..0cd41be22 100644
--- a/packages/binding.foreach/spec/eachBehavior.ts
+++ b/packages/binding.foreach/spec/eachBehavior.ts
@@ -176,6 +176,67 @@ describe('each binding', function () {
     $template.remove()
   })
 
+  it('applies the template size limit to named <script> templates', function () {
+    const originalTemplateSizeLimit = options.templateSizeLimit
+    const target = $('<ul data-bind=\'foreach: {name: "tID", data: $data}\'>Zee</ul>')
+    const $template = $("<script type='text/ko-template' id='tID'></script>").appendTo(document.body)
+    $template.text('<li data-bind="text: $data"></li>')
+
+    try {
+      options.templateSizeLimit = 10
+
+      assert.throws(function () {
+        applyBindings(['G1'], target[0])
+      }, /Template is too long/)
+    } finally {
+      options.templateSizeLimit = originalTemplateSizeLimit
+      $template.remove()
+    }
+  })
+
+  it('rejects nested script markup in named <script> templates when disallowed', function () {
+    const originalAllowScriptTagsInTemplates = options.allowScriptTagsInTemplates
+    const target = $('<ul data-bind=\'foreach: {name: "tID", data: $data}\'>Zee</ul>')
+    const $template = $("<script type='text/ko-template' id='tID'></script>").appendTo(document.body)
+    $template.text('<li data-bind="text: $data"></li><script>alert(1)</script>')
+
+    try {
+      options.allowScriptTagsInTemplates = false
+
+      assert.throws(function () {
+        applyBindings(['G1'], target[0])
+      }, /Script-tag in template detected/)
+    } finally {
+      options.allowScriptTagsInTemplates = originalAllowScriptTagsInTemplates
+      $template.remove()
+    }
+  })
+
+  it('sanitizes named <script> templates before rendering', function () {
+    const originalSanitizeHtmlTemplate = options.sanitizeHtmlTemplate
+    const target = $('<ul data-bind=\'foreach: {name: "tID", data: $data}\'>Zee</ul>')
+    const $template = $("<script type='text/ko-template' id='tID'></script>").appendTo(document.body)
+    const list = ['G1']
+    let sanitizedHtml = ''
+    $template.text('<li data-bind="text: $data"></li>')
+
+    try {
+      options.sanitizeHtmlTemplate = function (html: string) {
+        sanitizedHtml = html
+        return html.replace('<li ', '<li class="sanitized" ')
+      }
+
+      applyBindings(list, target[0])
+
+      assert.include(sanitizedHtml, 'text: $data')
+      assert.equal(target.find('li.sanitized').length, 1)
+      assert.equal(target.text(), 'G1')
+    } finally {
+      options.sanitizeHtmlTemplate = originalSanitizeHtmlTemplate
+      $template.remove()
+    }
+  })
+
   it('uses the name/id of a <div>', function () {
     const target = $('<ul data-bind=\'foreach: {name: "tID2", data: $data}\'>Zee</ul>')
     const list = ['H1', 'H2']
diff --git a/packages/binding.foreach/src/foreach.ts b/packages/binding.foreach/src/foreach.ts
index 1552dd722..550cc8909 100644
--- a/packages/binding.foreach/src/foreach.ts
+++ b/packages/binding.foreach/src/foreach.ts
@@ -12,7 +12,7 @@ import {
   virtualElements,
   domData,
   domNodeIsContainedBy,
-  validateHTMLInput
+  parseHtmlForTemplateNodes
 } from '@tko/utils'
 
 import { isObservable, unwrap, observable } from '@tko/observable'
@@ -21,8 +21,6 @@ import type { ObservableArray } from '@tko/observable'
 
 import { contextFor, applyBindingsToDescendants, AsyncBindingHandler } from '@tko/bind'
 
-import type { AllBindings } from '@tko/bind'
-
 //      Utilities
 const MAX_LIST_SIZE = Number.MAX_SAFE_INTEGER
 
@@ -64,8 +62,7 @@ function makeTemplateNode(sourceNode) {
     // For e.g. <template> tags
     parentNode = sourceNode.content
   } else if (sourceNode.tagName === 'SCRIPT') {
-    parentNode = document.createElement('div')
-    parentNode.innerHTML = validateHTMLInput(sourceNode.text)
+    parentNode = parseHtmlForTemplateNodes(sourceNode.text, sourceNode.ownerDocument)
   } else {
     // Anything else e.g. <div>
     parentNode = sourceNode
diff --git a/packages/utils/src/dom/html.ts b/packages/utils/src/dom/html.ts
index 7f3636d83..761c34036 100644
--- a/packages/utils/src/dom/html.ts
+++ b/packages/utils/src/dom/html.ts
@@ -68,7 +68,7 @@ export function parseHtmlFragment(html: string, documentContext?: Document): Nod
 }
 
 const scriptTagPattern = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/i
-export function validateHTMLInput(html: string): string {
+function validateHTMLInput(html: string): string {
   if (!html) return ''
 
   if (options.templateSizeLimit > 0 && html.length > options.templateSizeLimit) {