@fjpm03/sanitize-html 2.17.7 → 3.0.0

package/README.md

@@ -55,14 +55,14 @@ But, perhaps you'd like to display sanitized HTML immediately in the browser for
 * Install the package:
 
 ```bash
-npm install sanitize-html
+npm install sanitize-html@npm:@fjpm03/sanitize-html
 ```
 or
 ```
-yarn add sanitize-html
+yarn add sanitize-html@npm:@fjpm03/sanitize-html
 ```
 
-The primary change in the 2.x version of sanitize-html is that it no longer includes a build that is ready for browser use. Developers are expected to include sanitize-html in their project builds (e.g., webpack) as they would any other dependency. So while sanitize-html is no longer ready to link to directly in HTML, developers can now more easily process it according to their needs.
+The primary change in the 3.x version of this fork is that sanitize-html loads `htmlparser2` asynchronously because current `htmlparser2` releases are ESM-only. Consumers must await calls to `sanitizeHtml()`.
 
 Once built and linked in the browser with other project Javascript, it can be used to sanitize HTML strings in front end code:
 
@@ -70,10 +70,10 @@ Once built and linked in the browser with other project Javascript, it can be us
 import sanitizeHtml from 'sanitize-html';
 
 const html = "<strong>hello world</strong>";
-console.log(sanitizeHtml(html));
-console.log(sanitizeHtml("<img src=x onerror=alert('img') />"));
-console.log(sanitizeHtml("console.log('hello world')"));
-console.log(sanitizeHtml("<script>alert('hello world')</script>"));
+console.log(await sanitizeHtml(html));
+console.log(await sanitizeHtml("<img src=x onerror=alert('img') />"));
+console.log(await sanitizeHtml("console.log('hello world')"));
+console.log(await sanitizeHtml("<script>alert('hello world')</script>"));
 ```
 
 ### Node (Recommended)
@@ -81,7 +81,7 @@ console.log(sanitizeHtml("<script>alert('hello world')</script>"));
 Install module from console:
 
 ```bash
-npm install sanitize-html
+npm install sanitize-html@npm:@fjpm03/sanitize-html
 ```
 
 Import the module:
@@ -98,14 +98,14 @@ Use it in your JavaScript app:
 
 ```js
 const dirty = 'some really tacky HTML';
-const clean = sanitizeHtml(dirty);
+const clean = await sanitizeHtml(dirty);
 ```
 
 That will allow our [default list of allowed tags and attributes](#default-options) through. It's a nice set, but probably not quite what you want. So:
 
 ```js
 // Allow only a super restricted set of tags and attributes
-const clean = sanitizeHtml(dirty, {
+const clean = await sanitizeHtml(dirty, {
   allowedTags: [ 'b', 'i', 'em', 'strong', 'a' ],
   allowedAttributes: {
     'a': [ 'href' ]

package/index.js

@@ -1,10 +1,16 @@
-const htmlparser = require('htmlparser2');
 const escapeStringRegexp = require('escape-string-regexp');
 const { isPlainObject } = require('is-plain-object');
 const deepmerge = require('deepmerge');
 const parseSrcset = require('parse-srcset');
 const { parse: postcssParse } = require('postcss');
 const { naughtyHref: launderNaughtyHref } = require('launder');
+let htmlparserPromise;
+
+function getHtmlparser() {
+  htmlparserPromise = htmlparserPromise || import('htmlparser2');
+  return htmlparserPromise;
+}
+
 // Tags that can conceivably represent stand-alone media.
 const mediaTags = [
   'img', 'audio', 'video', 'picture', 'svg',
@@ -107,7 +113,12 @@ const VALID_HTML_ATTRIBUTE_NAME = /^[^\0\t\n\f\r /<=>]+$/;
 // invocation as a guard against this exploit:
 // https://github.com/fb55/htmlparser2/issues/105
 
-function sanitizeHtml(html, options, _recursing) {
+async function sanitizeHtml(html, options, _recursing) {
+  const htmlparser = await getHtmlparser();
+  return sanitizeHtmlWithParser(htmlparser, html, options, _recursing);
+}
+
+function sanitizeHtmlWithParser(htmlparser, html, options, _recursing) {
   if (html == null) {
     return '';
   }
@@ -661,7 +672,7 @@ function sanitizeHtml(html, options, _recursing) {
         !tagAllowed(tag) &&
         options.disallowedTagsMode === 'discard'
       ) {
-        result += sanitizeHtml(text, options);
+        result += sanitizeHtmlWithParser(htmlparser, text, options);
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
         if (options.textFilter) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjpm03/sanitize-html",
-  "version": "2.17.7",
+  "version": "3.0.0",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",