From fe9dd8f79cec135865ffdd251ceeb0182d278550 Mon Sep 17 00:00:00 2001
From: mohammed adib <adib@bugqore.com>
Date: Thu, 23 Jul 2026 13:48:33 +0530
Subject: [PATCH] block whitespace-separated !important in inline style
 sanitizer

---
 src/purifier/sanitation.js | 2 +-
 test/unit/test-purifier.js | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/purifier/sanitation.js b/src/purifier/sanitation.js
index 9c65b2614858..44e89fb4481c 100644
--- a/src/purifier/sanitation.js
+++ b/src/purifier/sanitation.js
@@ -348,7 +348,7 @@ const EMAIL_DENYLISTED_TAG_SPECIFIC_ATTRS = Object.freeze({
  * @const {!RegExp}
  */
 const INVALID_INLINE_STYLE_REGEX =
-  /!important|position\s*:\s*fixed|position\s*:\s*sticky/i;
+  /!\s*important|position\s*:\s*fixed|position\s*:\s*sticky/i;
 
 /**
  * Whether the attribute/value is valid.
diff --git a/test/unit/test-purifier.js b/test/unit/test-purifier.js
index 7b88bc1c0c1e..f0b80e21a52d 100644
--- a/test/unit/test-purifier.js
+++ b/test/unit/test-purifier.js
@@ -592,6 +592,14 @@ describes.sandboxed('DOMPurify-based', {}, (env) => {
         });
       });
 
+      it('should ignore styles containing spaced `! important`', () => {
+        allowConsoleError(() => {
+          expect(
+            purify('<div style="color:blue ! important">Test</div>')
+          ).to.equal('<div>Test</div>');
+        });
+      });
+
       it('should ignore styles containing `position:fixed`', () => {
         allowConsoleError(() => {
           expect(purify('<div style="position:fixed">Test</div>')).to.equal(