HtmlSanitizer has a bypass via template tag

@@ -498,7 +498,7 @@ private static void DefaultEncodeLiteralTextElementContent(IElement tag)
             tag.SetInnerText(escapedHtml);
     }
 
-    private void DoSanitize(IHtmlDocument dom, IParentNode context, string baseUrl = "")
+    private void DoSanitize(INode dom, IParentNode context, string baseUrl = "")
     {
         // remove disallowed tags
         foreach (var tag in context.QuerySelectorAll("*").Where(t => !IsAllowedTag(t)).ToList())
@@ -520,6 +520,11 @@ private void DoSanitize(IHtmlDocument dom, IParentNode context, string baseUrl =
         // cleanup attributes
         foreach (var tag in context.QuerySelectorAll("*").ToList())
         {
+            if (tag is IHtmlTemplateElement templateElement && templateElement.Content is IDocumentFragment fragment)
+            {
+                DoSanitize(fragment, fragment, baseUrl);
+            }
+
             // remove disallowed attributes
             foreach (var attribute in tag.Attributes.Where(a => !IsAllowedAttribute(a)).ToList())
             {
@@ -575,12 +580,17 @@ private void DoSanitize(IHtmlDocument dom, IParentNode context, string baseUrl =
             RemoveComments(node);
         }
 
-        DoPostProcess(dom, context as INode);
+        var doc = dom as IHtmlDocument ?? dom.Owner as IHtmlDocument;
+
+        if (doc != null)
+        {
+            DoPostProcess(doc, context as INode);
+        }
     }
 
-    private void SanitizeStyleSheets(IHtmlDocument dom, string baseUrl)
+    private void SanitizeStyleSheets(INode node, string baseUrl)
     {
-        foreach (var styleSheet in dom.StyleSheets.OfType<ICssStyleSheet>())
+        foreach (var styleSheet in node.GetStyleSheets().OfType<ICssStyleSheet>())
         {
             var styleTag = styleSheet.OwnerNode;
             var i = 0;

@@ -3629,4 +3629,17 @@ public void DisallowStyleTagCssCustomPropertiesTest()
         var sanitized = sanitizer.Sanitize(input);
         Assert.Equal("<style>:root { }</style>", sanitized);
     }
+
+    [Fact]
+    public void TemplateTest()
+    {
+        var sanitizer = new HtmlSanitizer();
+        sanitizer.AllowedTags.Add("template");
+        sanitizer.AllowedTags.Add("style");
+
+        var html = "<div><template><style>div { display: none }</style><script>alert('xss')</script></template></div>";
+        var sanitized = sanitizer.Sanitize(html);
+        var expected = "<div><template><style>div { display: none }</style></template></div>";
+        Assert.Equal(expected, sanitized);
+    }
 }