From 2445554f4f42bf9fa9c23dc7d9f127209ebc4783 Mon Sep 17 00:00:00 2001
From: Russell Bicknell <bicknellr@google.com>
Date: Wed, 27 Apr 2022 15:18:29 -0700
Subject: [PATCH] Upstream http://cl/397536696

---
 lib/utils/html-tag.js | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/lib/utils/html-tag.js b/lib/utils/html-tag.js
index bde13b517..6a5f62477 100644
--- a/lib/utils/html-tag.js
+++ b/lib/utils/html-tag.js
@@ -68,15 +68,13 @@ function literalValue(value) {
  */
 function htmlValue(value) {
   if (value instanceof HTMLTemplateElement) {
-    // Use the XML serializer to avoid xMSS attacks from browsers' sometimes
-    // unexpected formatting / cleanup of innerHTML.
-    const serializedNewTree = new XMLSerializer().serializeToString(
-        /** @type {!HTMLTemplateElement } */ (value));
-    // The XMLSerializer is similar to .outerHTML, so slice off the leading
-    // and trailing parts of the <template> wrapper tag.
-    return serializedNewTree.slice(
-        serializedNewTree.indexOf('>') + 1,
-        serializedNewTree.lastIndexOf('</'));
+    // This might be an mXSS risk – mainly in the case where this template
+    // contains untrusted content that was believed to be sanitized.
+    // However we can't just use the XMLSerializer here because it misencodes
+    // `>` characters inside style tags.
+    // For an example of an actual case that hit this encoding issue,
+    // see b/198592167
+    return /** @type {!HTMLTemplateElement } */(value).innerHTML;
   } else if (value instanceof LiteralString) {
     return literalValue(value);
   } else {