Let's say you have whitelisted the img tag. The following will not get filtered (good):

<img src="cat.jpg"/>

And neither will this (good):

<img
src="cat.jpg"/>

However, this will get filtered (bad):

<img/src="cat.jpg"/>

The use of / as a separator is supported by browsers so this ought to work. As reported in this article, the following characters may be used to separate attributes in an HTML tag:

• Space (0x20)
• Slash (0x2F)
• Carriage-Return (0x0D)
• Line-Feed (0x0A)
• Horizontal Tab (0x09)
• Form-Feed (0x0C)

The problem seems to be that the regexes in spaceIndex() and parseAttr() do not know about slashes:

Therefore, getTagName() should return img, but incorrectly returns img/src="cat.jpg" instead (which is obviously not on the whitelist). The attribute parser has the same issue: it comes back with all the attributes in one string separated by /.

The regexes in the code snippets above are doubly redundant, because \n (literal newline) and \t (literal tab) will already get matched by \s (any whitespace character). All of the other whitespace characters in the list above will also get matched by \s.

I can provide a PR that will fix the issue.