Galit Tugi

Commented vulnerability is sanitized without being notified in HtmlChangeListener

2

The following string: `-->` is being cleaned up by the sanitizer, the comment is just being removed, but this does not go through the htmlChangeListener object. Eventually, a malicious code...