From 24c6c780837d9cae4d7f872669813bb562de6807 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Sat, 19 Sep 2026 04:52:16 -0700
Subject: [PATCH 1/3] Give a caption or column group under a dropped template
 its table in Sanitizers.TABLES

A template holds a caption or column group directly, so the containment
metadata implies no table for one there, but a template the policy
dropped or renamed establishes none in the output: the part landed where
the template was as an orphan that a browser drops, and the next pass
gave it its table.  The part is now judged in the output, where the
template stood, by the rule that already judges an option there, so
Sanitizers.TABLES emits on the first pass what it emitted on the second.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 change_log.md                                 |  5 ++
 .../TagBalancingHtmlStreamEventReceiver.java  | 19 +++--
 .../org/owasp/html/HtmlSanitizerTest.java     | 69 +++++++++++++++++++
 3 files changed, 86 insertions(+), 7 deletions(-)

diff --git a/change_log.md b/change_log.md
index e7d2581c..453f08e7 100644
--- a/change_log.md
+++ b/change_log.md
@@ -2,6 +2,11 @@
 
 Most recent at top.
   * Next release
+    * A caption or column group under a `template` the policy dropped is
+      judged in the output, where the template was, and gets its table there,
+      instead of coming out as an orphan part that a browser drops and the
+      next pass wraps; `Sanitizers.TABLES` now emits on the first pass what
+      it emitted on the second (#492, item 2).
     * An `option` or `optgroup` under any element but a `select`, `optgroup`
       or `option` now gets its `select`, and a list item under any element
       but a list its list, whatever the container's name (a list the policy
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
index 62715b38..984f5b39 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
@@ -3097,19 +3097,24 @@ && hasUnavailableOutputlessTable()) {
         && outputElements.get(containerIndexOnStack) != TEMPLATE_TAG) {
       return BODY_TAG;
     }
-    if ((child == OPTION_TAG || child == OPTGROUP_TAG)
+    if ((child == OPTION_TAG || child == OPTGROUP_TAG
+            || child == CAPTION_TAG || child == COLGROUP_TAG)
         && !isOutputInForeignContent()
         && containerIndexOnStack >= 0
         && containerIndexOnStack < openElements.size()
         && openElements.get(containerIndexOnStack) == TEMPLATE_TAG
         && outputElements.get(containerIndexOnStack) != TEMPLATE_TAG
         && sentToUnderlying.get(containerIndexOnStack)) {
-      // A template holds an option or optgroup directly, so the containment
-      // metadata implies no select for one there, but a template the policy
-      // dropped or renamed establishes none in the output: the option lands
-      // where the template was, or in what the template became, and is
-      // judged there, so it gets the select it gets in that place instead
-      // of coming out bare for the next pass to wrap (#492).
+      // A template holds an option, optgroup, caption or column group
+      // directly, so the containment metadata implies no select or table
+      // for one there, but a template the policy dropped or renamed
+      // establishes none in the output: the element lands where the
+      // template was, or in what the template became, and is judged there,
+      // so it gets the select or table it gets in that place instead of
+      // coming out bare, an orphan caption that the output parser drops,
+      // for the next pass to wrap (#492, items 9 and 2).  The other table
+      // parts already get their table under a template through the
+      // metadata.
       int outputContainer = outputContainerIndex();
       return outputContainer != UNRECOGNIZED_TAG ? outputContainer : BODY_TAG;
     }
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index 8e384ff1..5a64c683 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -5784,6 +5784,75 @@ public String apply(String elementName, List<String> attrs) {
         "<u><template><option>x</option></template></u>");
   }
 
+  /**
+   * Item 2 of #492.  A template holds a caption or column group directly,
+   * so the containment metadata implies no table for one there.  A template
+   * the policy dropped establishes no template in the output, though: the
+   * caption landed where the template was, as an orphan that a browser
+   * drops, and the next pass gave it its table.  Parts under a dropped
+   * template are now judged where the template was.  The prepackaged
+   * policies drop the template and, being allowed no `table` they did not
+   * emit before, the output narrows to what the second pass already gave.
+   */
+  @Test
+  void testTablePartUnderDroppedTemplateGetsItsTable() throws Exception {
+    String[][] tables = {
+        { "<template><ul><math><caption>TEXT",
+          "<table><caption>TEXT</caption></table>" },
+        { "<template><ul><svg><caption>TEXT",
+          "<table><caption>TEXT</caption></table>" },
+        { "<template><ul><math><colgroup>TEXT",
+          "<table><colgroup></colgroup></table>TEXT" },
+        { "<template><caption>TEXT", "<table><caption>TEXT</caption></table>" },
+        { "<template><caption>TEXT</caption></template>after",
+          "<table><caption>TEXT</caption></table>after" },
+        { "<div><template><caption>TEXT",
+          "<table><caption>TEXT</caption></table>" },
+        // A cell already got its table there.
+        { "<template><ul><math><td>TEXT",
+          "<table><tbody><tr><td>TEXT</td></tr></tbody></table>" },
+        // Hostile content in the caption's place is still removed.
+        { "<template><caption><script>alert(1)</script>TEXT",
+          "<table><caption>TEXT</caption></table>" },
+        { "<template><ul><math><caption onclick=alert(1)>TEXT"
+          + "<img src=x onerror=alert(1)>",
+          "<table><caption>TEXT</caption></table>" },
+    };
+    for (String[] c : tables) {
+      assertRoundTripAndBalanced(Sanitizers.TABLES, c[0], c[1]);
+      assertFalse(Sanitizers.TABLES.sanitize(c[0]).contains("alert"), c[0]);
+    }
+    // The template's place is judged in the output: a formatting element
+    // the policy keeps around the dropped template is the caption's
+    // container there, and a browser drops a caption written in it, so it
+    // stays as it was; under a container the policy also drops, the caption
+    // gets its table.
+    assertRoundTripAndBalanced(
+        Sanitizers.TABLES, "<u><template><caption>TEXT",
+        "<table><caption>TEXT</caption></table>");
+    assertRoundTripAndBalanced(
+        Sanitizers.TABLES, "<u><template><colgroup>TEXT",
+        "<table><colgroup></colgroup></table>TEXT");
+    // With the list kept, the caption's table stands beside the list, as it
+    // does for <ul><caption> without the template.
+    assertRoundTripAndBalanced(
+        Sanitizers.BLOCKS.and(Sanitizers.TABLES),
+        "<template><ul><math><caption>TEXT",
+        "<ul><li></li></ul><table><caption>TEXT</caption></table>");
+    // A template the policy keeps still holds the caption directly, as a
+    // browser does.
+    PolicyFactory withTemplate = new HtmlPolicyBuilder()
+        .allowElements("table", "caption", "colgroup", "template")
+        .toFactory();
+    assertRoundTripAndBalanced(
+        withTemplate, "<template><caption>TEXT</caption></template>",
+        "<template><caption>TEXT</caption></template>");
+    assertEquals(
+        parseAsBrowser("<template><caption>TEXT</caption></template>"),
+        parseAsBrowser(
+            withTemplate.sanitize("<template><caption>TEXT</caption></template>")));
+  }
+
   /**
    * Item 1 of #492.  The list item the containment metadata implies for a
    * list's content landed inside a forwarded SVG or MathML root: the root

From f9a0c8764c074c24ab63fd909fb552f11af472f7 Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Sat, 19 Sep 2026 05:18:35 -0700
Subject: [PATCH 2/3] Take the review: a dropped template bounds no table
 scope, and holds a col directly too

A part under a template the policy dropped, inside an open table, now
returns to that table as a browser reading the output does, closing a
column group, cell or row, instead of opening a second table or coming
out bare in the cell: the dropped template is no table-scope boundary in
the output, and the close loop judges what a dropped template can hold
where its content lands, so a caption under one inside a kept formatting
element closes it and gets its table beside it, as without the template.
A col is held directly by a template as well and gets its table the same
way.  Tests cover the open-table, cell, formatting and col shapes, a
hostile column group, and a policy that drops the part itself.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 change_log.md                                 | 14 +++--
 .../TagBalancingHtmlStreamEventReceiver.java  | 25 +++++++--
 .../org/owasp/html/HtmlSanitizerTest.java     | 53 ++++++++++++++++---
 3 files changed, 77 insertions(+), 15 deletions(-)

diff --git a/change_log.md b/change_log.md
index 453f08e7..447b6909 100644
--- a/change_log.md
+++ b/change_log.md
@@ -2,11 +2,15 @@
 
 Most recent at top.
   * Next release
-    * A caption or column group under a `template` the policy dropped is
-      judged in the output, where the template was, and gets its table there,
-      instead of coming out as an orphan part that a browser drops and the
-      next pass wraps; `Sanitizers.TABLES` now emits on the first pass what
-      it emitted on the second (#492, item 2).
+    * A caption, column group or `col` under a `template` the policy dropped
+      is judged in the output, where the template was, and gets its table
+      there, instead of coming out as an orphan part that a browser drops
+      and the next pass wraps; a dropped template bounds no table scope
+      either, so such a part inside an open table returns to that table as
+      it does without the template.  `Sanitizers.TABLES` now emits on the
+      first pass what it emitted on the second, and a policy that drops the
+      part itself gets the same table beside the text as it does for the
+      bare part (#492, item 2).
     * An `option` or `optgroup` under any element but a `select`, `optgroup`
       or `option` now gets its `select`, and a list item under any element
       but a list its list, whatever the container's name (a list the policy
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
index 984f5b39..351ef684 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
@@ -2356,7 +2356,11 @@ && lastOutputElementStartsForeignContent(
     while (true) {
       int container = containerIndex();
       if (container < 0 || container < foreignRootBoundary) { break; }
-      int top = openElements.get(container);
+      // A template the policy dropped is no container in the output: what
+      // it can hold is judged where its content lands (#492, item 2).
+      int top = isDroppedTemplate(container)
+          ? effectiveContainer(elIndex, container)
+          : openElements.get(container);
       // A link ends the link open before it, wherever that is: nested links
       // do not survive a browser's parse, so a table between them cannot
       // stay open either.
@@ -2850,7 +2854,12 @@ private boolean returnToTableContext(int elIndex) {
         table = i;
         break;
       }
-      if ((SCOPES_BY_ELEMENT[openElementIndex] & tableScope) != 0) {
+      if ((SCOPES_BY_ELEMENT[openElementIndex] & tableScope) != 0
+          && !isDroppedTemplate(i)) {
+        // A template the policy dropped establishes no template in the
+        // output, so it bounds no table scope there: a part under it
+        // returns to the open table as a browser reading the output does
+        // (#492, item 2).
         return true;
       }
     }
@@ -3098,14 +3107,15 @@ && hasUnavailableOutputlessTable()) {
       return BODY_TAG;
     }
     if ((child == OPTION_TAG || child == OPTGROUP_TAG
-            || child == CAPTION_TAG || child == COLGROUP_TAG)
+            || child == CAPTION_TAG || child == COLGROUP_TAG
+            || child == COL_TAG)
         && !isOutputInForeignContent()
         && containerIndexOnStack >= 0
         && containerIndexOnStack < openElements.size()
         && openElements.get(containerIndexOnStack) == TEMPLATE_TAG
         && outputElements.get(containerIndexOnStack) != TEMPLATE_TAG
         && sentToUnderlying.get(containerIndexOnStack)) {
-      // A template holds an option, optgroup, caption or column group
+      // A template holds an option, optgroup, caption, column group or col
       // directly, so the containment metadata implies no select or table
       // for one there, but a template the policy dropped or renamed
       // establishes none in the output: the element lands where the
@@ -3222,6 +3232,13 @@ private boolean impliedPathEndsInContainer(int container, int child) {
     return METADATA.canContain(innermost, child);
   }
 
+  /** Whether the entry is a template the policy dropped. */
+  private boolean isDroppedTemplate(int stackIndex) {
+    return openElements.get(stackIndex) == TEMPLATE_TAG
+        && outputElements.get(stackIndex) == NO_OUTPUT_ELEMENT
+        && sentToUnderlying.get(stackIndex);
+  }
+
   /** Whether a dropped logical template contains the stack entry. */
   private boolean hasOutputlessTemplateBelow(int stackIndex) {
     for (int i = stackIndex; --i >= 0;) {
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index 5a64c683..a9f9e9a8 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -5820,19 +5820,60 @@ void testTablePartUnderDroppedTemplateGetsItsTable() throws Exception {
     };
     for (String[] c : tables) {
       assertRoundTripAndBalanced(Sanitizers.TABLES, c[0], c[1]);
-      assertFalse(Sanitizers.TABLES.sanitize(c[0]).contains("alert"), c[0]);
     }
-    // The template's place is judged in the output: a formatting element
-    // the policy keeps around the dropped template is the caption's
-    // container there, and a browser drops a caption written in it, so it
-    // stays as it was; under a container the policy also drops, the caption
-    // gets its table.
+    // A dropped template bounds no table scope in the output: a part under
+    // it inside an open table returns to that table, closing a column
+    // group, a cell or a row as a browser reading the output does, instead
+    // of opening a second table or coming out bare in the cell.
+    String[][] inTable = {
+        { "<table><colgroup><template><caption>x",
+          "<table><colgroup></colgroup><caption>x</caption></table>" },
+        { "<table><tr><td><template><caption>x",
+          "<table><tbody><tr><td></td></tr></tbody><caption>x</caption>"
+          + "</table>" },
+        { "<table><td>a<template><caption>x</template>b",
+          "<table><tbody><tr><td>a</td></tr></tbody><caption>xb</caption>"
+          + "</table>" },
+        { "<table><tbody><template><colgroup>x",
+          "<table><tbody></tbody><colgroup></colgroup></table>x" },
+        // A col is held directly by a template too.
+        { "<template><col>x", "<table><colgroup><col /></colgroup></table>x" },
+        { "<template><ul><math><col>x",
+          "<table><colgroup><col /></colgroup></table>x" },
+        { "<template><colgroup onclick=alert(1)><col onclick=alert(1)>"
+          + "<script>alert(1)</script>x",
+          "<table><colgroup><col /></colgroup></table>x" },
+    };
+    for (String[] c : inTable) {
+      assertRoundTripAndBalanced(Sanitizers.TABLES, c[0], c[1]);
+    }
+    // The template's place is judged in the output.  Under a container the
+    // policy drops, the caption gets its table; under a formatting element
+    // the policy keeps, the caption closes it and gets its table beside it,
+    // exactly as the caption does without the template.
     assertRoundTripAndBalanced(
         Sanitizers.TABLES, "<u><template><caption>TEXT",
         "<table><caption>TEXT</caption></table>");
     assertRoundTripAndBalanced(
         Sanitizers.TABLES, "<u><template><colgroup>TEXT",
         "<table><colgroup></colgroup></table>TEXT");
+    PolicyFactory formattingTables =
+        Sanitizers.FORMATTING.and(Sanitizers.TABLES);
+    assertRoundTripAndBalanced(
+        formattingTables, "<u><template><caption>TEXT",
+        "<u></u><table><caption><u>TEXT</u></caption></table>");
+    assertEquals(
+        formattingTables.sanitize("<u><caption>TEXT"),
+        formattingTables.sanitize("<u><template><caption>TEXT"));
+    // A policy that drops the caption itself still gets the part's table,
+    // as it does for a bare caption without the template.
+    PolicyFactory noCaption = new HtmlPolicyBuilder()
+        .allowElements("table", "tr", "td", "u").toFactory();
+    assertEquals(
+        noCaption.sanitize("<caption>x"),
+        noCaption.sanitize("<template><caption>x"));
+    assertRoundTripAndBalanced(
+        noCaption, "<template><caption>x", "<table></table>x");
     // With the list kept, the caption's table stands beside the list, as it
     // does for <ul><caption> without the template.
     assertRoundTripAndBalanced(

From 9ebd255ce10bc7ed18900691830cd5fac72088ef Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Sat, 19 Sep 2026 09:19:54 -0700
Subject: [PATCH 3/3] Take the review: keep the rule to the container, not to
 table scope

A review reproduced three regressions in the scope and closing changes
this branch added, all in states its tests never entered: a part under a
dropped template at an HTML integration point came out as the orphan this
change exists to remove; the closing loop that returns a part to an open
table is the one pop site that never queues formatting to reconstruct, so
a u around the caption was destroyed; and judging the container by the
output made a dropped template look like a dropped raw-text container, so
the caption's own text was deleted under disallowTextIn("template").

Both changes are reverted.  What stays is the container rule, which the
review found sound: a caption, column group or col under a template the
policy dropped or renamed is judged where the template stood.  The text
deletion is fixed by keeping a dropped template out of the dropped
raw-text container path.  A part under a template inside an open table
keeps the shape it had, which is not a fixed point here or on main; that
belongs with the five other scans that read table scope the same way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 change_log.md                                 | 17 +++---
 .../TagBalancingHtmlStreamEventReceiver.java  | 22 ++++---
 .../org/owasp/html/HtmlSanitizerTest.java     | 60 ++++++++++++-------
 3 files changed, 56 insertions(+), 43 deletions(-)

diff --git a/change_log.md b/change_log.md
index 447b6909..d59d1e0e 100644
--- a/change_log.md
+++ b/change_log.md
@@ -3,14 +3,15 @@
 Most recent at top.
   * Next release
     * A caption, column group or `col` under a `template` the policy dropped
-      is judged in the output, where the template was, and gets its table
-      there, instead of coming out as an orphan part that a browser drops
-      and the next pass wraps; a dropped template bounds no table scope
-      either, so such a part inside an open table returns to that table as
-      it does without the template.  `Sanitizers.TABLES` now emits on the
-      first pass what it emitted on the second, and a policy that drops the
-      part itself gets the same table beside the text as it does for the
-      bare part (#492, item 2).
+      or renamed is judged in the output, where the template stood, and gets
+      its table there, instead of coming out as an orphan part that a
+      browser drops and the next pass wraps.  `Sanitizers.TABLES` emits on
+      the first pass what it emitted on the second for those shapes, and a
+      policy that drops the part itself, or disallows text in the template,
+      gets what it gets for the same part without the template.  A part
+      under a template inside an open table keeps the shape it had: the
+      template still bounds table scope, which five other scans read the
+      same way (#492, item 2).
     * An `option` or `optgroup` under any element but a `select`, `optgroup`
       or `option` now gets its `select`, and a list item under any element
       but a list its list, whatever the container's name (a list the policy
diff --git a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
index 351ef684..512d0954 100644
--- a/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
+++ b/owasp-java-html-sanitizer/src/main/java/org/owasp/html/TagBalancingHtmlStreamEventReceiver.java
@@ -2126,7 +2126,12 @@ && outputAllowsImplicitTableReturn()) {
           && (container < 0 || !canHold(elIndex, top, container))) {
         // A dropped raw-text container cannot hide an emitted paragraph from
         // the implied table that the output parser will place beside it.
+        // A dropped template is not such a container: the part under it is
+        // judged where the template stood, and its own content is the
+        // part's, so suppressing it would delete the text of a caption the
+        // policy keeps (#492, item 2).
         if (container >= 0
+            && !isDroppedTemplate(container)
             && outputElements.get(container) == NO_OUTPUT_ELEMENT
             && contentIsSkippable(
                 METADATA.canonNameForIndex(openElements.get(container)))) {
@@ -2356,11 +2361,7 @@ && lastOutputElementStartsForeignContent(
     while (true) {
       int container = containerIndex();
       if (container < 0 || container < foreignRootBoundary) { break; }
-      // A template the policy dropped is no container in the output: what
-      // it can hold is judged where its content lands (#492, item 2).
-      int top = isDroppedTemplate(container)
-          ? effectiveContainer(elIndex, container)
-          : openElements.get(container);
+      int top = openElements.get(container);
       // A link ends the link open before it, wherever that is: nested links
       // do not survive a browser's parse, so a table between them cannot
       // stay open either.
@@ -2854,12 +2855,7 @@ private boolean returnToTableContext(int elIndex) {
         table = i;
         break;
       }
-      if ((SCOPES_BY_ELEMENT[openElementIndex] & tableScope) != 0
-          && !isDroppedTemplate(i)) {
-        // A template the policy dropped establishes no template in the
-        // output, so it bounds no table scope there: a part under it
-        // returns to the open table as a browser reading the output does
-        // (#492, item 2).
+      if ((SCOPES_BY_ELEMENT[openElementIndex] & tableScope) != 0) {
         return true;
       }
     }
@@ -3234,7 +3230,9 @@ private boolean impliedPathEndsInContainer(int container, int child) {
 
   /** Whether the entry is a template the policy dropped. */
   private boolean isDroppedTemplate(int stackIndex) {
-    return openElements.get(stackIndex) == TEMPLATE_TAG
+    return stackIndex >= 0
+        && stackIndex < openElements.size()
+        && openElements.get(stackIndex) == TEMPLATE_TAG
         && outputElements.get(stackIndex) == NO_OUTPUT_ELEMENT
         && sentToUnderlying.get(stackIndex);
   }
diff --git a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
index a9f9e9a8..c56d33c1 100644
--- a/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
+++ b/owasp-java-html-sanitizer/src/test/java/org/owasp/html/HtmlSanitizerTest.java
@@ -5823,19 +5823,11 @@ void testTablePartUnderDroppedTemplateGetsItsTable() throws Exception {
     }
     // A dropped template bounds no table scope in the output: a part under
     // it inside an open table returns to that table, closing a column
-    // group, a cell or a row as a browser reading the output does, instead
-    // of opening a second table or coming out bare in the cell.
+    // group, or comes out beside the table it was written in.
     String[][] inTable = {
         { "<table><colgroup><template><caption>x",
-          "<table><colgroup></colgroup><caption>x</caption></table>" },
-        { "<table><tr><td><template><caption>x",
-          "<table><tbody><tr><td></td></tr></tbody><caption>x</caption>"
-          + "</table>" },
-        { "<table><td>a<template><caption>x</template>b",
-          "<table><tbody><tr><td>a</td></tr></tbody><caption>xb</caption>"
-          + "</table>" },
-        { "<table><tbody><template><colgroup>x",
-          "<table><tbody></tbody><colgroup></colgroup></table>x" },
+          "<table><colgroup></colgroup></table>"
+          + "<table><caption>x</caption></table>" },
         // A col is held directly by a template too.
         { "<template><col>x", "<table><colgroup><col /></colgroup></table>x" },
         { "<template><ul><math><col>x",
@@ -5846,25 +5838,47 @@ void testTablePartUnderDroppedTemplateGetsItsTable() throws Exception {
     };
     for (String[] c : inTable) {
       assertRoundTripAndBalanced(Sanitizers.TABLES, c[0], c[1]);
+      assertFalse(
+          Sanitizers.TABLES.sanitize(c[0]).contains("alert"), c[0]);
+    }
+    // Text the policy disallows in the template is not the caption's, so
+    // the caption a template holds keeps its own, as it does without one.
+    PolicyFactory noTemplateText = new HtmlPolicyBuilder()
+        .allowElements("table", "caption", "colgroup", "col")
+        .disallowTextIn("template").toFactory();
+    assertEquals(
+        noTemplateText.sanitize("<caption>TEXT</caption>"),
+        noTemplateText.sanitize("<template><caption>TEXT</caption></template>"));
+    assertRoundTripAndBalanced(
+        noTemplateText, "<template><caption>TEXT</caption></template>",
+        "<table><caption>TEXT</caption></table>");
+    // A part under a template inside an open table keeps the shape it has
+    // without this change: the template still bounds table scope, so the
+    // part stays in the cell and the next pass moves it, as it does on its
+    // own.  Closing that scope belongs with the other five scans that read
+    // it, not with this rule.
+    String[] inCell = {
+        "<table><tr><td><template><caption>x",
+        "<table><tbody><template><colgroup>x",
+    };
+    for (String c : inCell) {
+      assertEquals(
+          Sanitizers.TABLES.sanitize(c.replace("<template>", "")),
+          Sanitizers.TABLES.sanitize(
+              Sanitizers.TABLES.sanitize(c)),
+          c);
     }
-    // The template's place is judged in the output.  Under a container the
-    // policy drops, the caption gets its table; under a formatting element
-    // the policy keeps, the caption closes it and gets its table beside it,
-    // exactly as the caption does without the template.
+    // The template's place is judged in the output: under a container the
+    // policy drops, the caption gets its table there.  A formatting
+    // element the policy keeps is the container in the output, and a
+    // browser drops a caption written in one, so that shape is left as it
+    // was, non-idempotent here as on its own.
     assertRoundTripAndBalanced(
         Sanitizers.TABLES, "<u><template><caption>TEXT",
         "<table><caption>TEXT</caption></table>");
     assertRoundTripAndBalanced(
         Sanitizers.TABLES, "<u><template><colgroup>TEXT",
         "<table><colgroup></colgroup></table>TEXT");
-    PolicyFactory formattingTables =
-        Sanitizers.FORMATTING.and(Sanitizers.TABLES);
-    assertRoundTripAndBalanced(
-        formattingTables, "<u><template><caption>TEXT",
-        "<u></u><table><caption><u>TEXT</u></caption></table>");
-    assertEquals(
-        formattingTables.sanitize("<u><caption>TEXT"),
-        formattingTables.sanitize("<u><template><caption>TEXT"));
     // A policy that drops the caption itself still gets the part's table,
     // as it does for a bare caption without the template.
     PolicyFactory noCaption = new HtmlPolicyBuilder()