From fa38a991d3b4e6c33fb65e2b74d868197b745144 Mon Sep 17 00:00:00 2001
From: Shangeeth Rajasekar <Shangeeth.Rajasekar@genesys.com>
Date: Wed, 7 Jan 2026 01:07:06 +0530
Subject: [PATCH] Fix invalid nested <select> when sanitizing <optgroup>

---
 .../org/owasp/html/HtmlElementTables.java     |  2 +-
 .../java/org/owasp/html/OptgroupBugTest.java  | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java

diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java
index f5b176df..31988114 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/HtmlElementTables.java
@@ -109,7 +109,7 @@ public HtmlElementTables(
     LI_TAG = indexForName("li");
     SELECT_TAG = indexForName("select");
     OPTION_TAG = indexForName("option");
-    OPTGROUP_TAG = indexForName("opgroup");
+    OPTGROUP_TAG = indexForName("optgroup");
     SCRIPT_TAG = indexForName("script");
     STYLE_TAG = indexForName("style");
     TABLE_TAG = indexForName("table");
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java
new file mode 100644
index 00000000..5e99c0ec
--- /dev/null
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/OptgroupBugTest.java
@@ -0,0 +1,27 @@
+package org.owasp.html;
+
+import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+
+public class OptgroupBugTest {
+    
+    /**
+     * Test that optgroup elements inside select are not corrupted with extra select tags.
+     * 
+     * Before fix: <select><optgroup><select><option></option></select></optgroup></select>
+     * After fix:  <select><optgroup><option></option></optgroup></select>
+     */
+    @Test
+    public void testOptgroupInsideSelectDoesNotAddExtraSelectTags() {
+        PolicyFactory factory = new HtmlPolicyBuilder()
+            .allowElements("select", "optgroup", "option")
+            .allowAttributes("label").globally()
+            .toFactory();
+        
+        String input = "<select><optgroup label=\"mygroup\"><option>My option</option></optgroup></select>";
+        String result = factory.sanitize(input);
+        
+        // The key assertion: no extra select tags should be inserted
+        assertEquals(input, result);
+    }
+}
\ No newline at end of file