From bffd20ba019917f9dc034985a149ed9295b92d6d Mon Sep 17 00:00:00 2001
From: Frans de Jonge <fransdejonge@gmail.com>
Date: Sun, 19 Jul 2026 11:50:56 +0200
Subject: [PATCH] Simplepie: fix sanitizer whitelist stripping order (#9066)

* Simplepie: fix sanitizer whitelist stripping order

Includes <https://github.com/FreshRSS/simplepie/pull/85>.

Fixes <https://github.com/FreshRSS/FreshRSS/issues/9052>.

* composer update --no-autoloader
---
 lib/composer.json                        |  2 +-
 lib/simplepie/simplepie/src/Sanitize.php | 14 ++++++++------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/composer.json b/lib/composer.json
index 54c1dbd5a..a98f3a0bc 100644
--- a/lib/composer.json
+++ b/lib/composer.json
@@ -18,7 +18,7 @@
 		"marienfressinaud/lib_opml": "dev-main#f0e850b6394af90b898daf0e65fcc7363457b844",
 		"phpgt/cssxpath": "v1.5.0",
 		"phpmailer/phpmailer": "7.1.1",
-		"simplepie/simplepie": "dev-freshrss#2d4c5b99b8f851b1e416b84f6a9a1e85097b9012"
+		"simplepie/simplepie": "dev-freshrss#5c4cd94907c066f1db5ccd9c6d4610ecba114e39"
 	},
 	"config": {
 		"sort-packages": true,
diff --git a/lib/simplepie/simplepie/src/Sanitize.php b/lib/simplepie/simplepie/src/Sanitize.php
index 7ab068046..819071391 100644
--- a/lib/simplepie/simplepie/src/Sanitize.php
+++ b/lib/simplepie/simplepie/src/Sanitize.php
@@ -721,16 +721,18 @@ class Sanitize implements RegistryAware
                 && !isset($this->allowed_html_elements_with_attributes[$tag])) {
                 if (!in_array($tag, ['script', 'style', 'svg', 'math', 'template'], true)) {
                     // Preserve children inside the disallowed element
-                    for ($i = $element->childNodes->length - 1; $i >= 0; $i--) {
-                        $child = $element->childNodes->item($i);
-                        if ($child === null) {
-                            continue;
-                        }
+                    $nextSibling = $element->nextSibling;
+                    while ($element->firstChild !== null) {
+                        $child = $element->firstChild;
                         if ($child instanceof \DOMText) {
                             $child->nodeValue = htmlspecialchars($child->nodeValue ?? '', ENT_QUOTES, 'UTF-8');
                         }
                         if ($parent !== null) {
-                            $parent->insertBefore($child, $element);
+                            if ($nextSibling !== null) {
+                                $parent->insertBefore($child, $nextSibling);
+                            } else {
+                                $parent->appendChild($child);
+                            }
                         }
                         $this->enforce_allowed_html_nodes($child, $allow_data_attr, $allow_aria_attr);
                     }