npm - sanitize-html - Versions diffs - 1.11.4 → 1.14.1 - Mend

sanitize-html 1.11.4 → 1.14.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/.npmignore CHANGED Viewed

@@ -1,5 +1,6 @@
 npm-debug.log
 *.DS_Store
 node_modules
+dist
 # We do not commit CSS, only LESS
 public/css/*.css

package/README.md CHANGED Viewed

@@ -22,6 +22,43 @@ HTML comments are not preserved.
 ## How to use
+### Browser
+*Think first: why do you want to use it in the browser?* Remember, *servers must never trust browsers.* You can't sanitize HTML for saving on the server anywhere else but on the server.
+But, perhaps you'd like to display sanitized HTML immediately in the browser for preview. Or ask the browser to do the sanitization work on every page load. You can if you want to!
+* Clone repository
+* Run npm install and build / minify:
+```bash
+npm install
+npm run minify
+```
+You'll find the minified and unminified versions of sanitize-html (with all its dependencies included) in the dist/ directory.
+Use it in the browser:
+```html
+<html>
+    <body>
+        <script type="text/javascript"  src="dist/sanitize-html.js"></script>
+        <script type="text/javascript" src="demo.js"></script>
+    </body>
+</html>
+```
+```javascript
+var html = "<strong>hello world</strong>";
+console.log(sanitizeHtml(html));
+console.log(sanitizeHtml("<img src=x onerror=alert('img') />"));
+console.log(sanitizeHtml("console.log('hello world')"));
+console.log(sanitizeHtml("<script>alert('hello world')</script>"));
+```
+### Node (Recommended)
 Install module from console:
 ```bash
@@ -77,7 +114,8 @@ allowedAttributes: {
 selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
 // URL schemes we permit
 allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
-allowedSchemesByTag: {}
+allowedSchemesByTag: {},
+allowProtocolRelative: true
 ```
 #### "What if I want to allow all tags or all attributes?"
@@ -184,6 +222,29 @@ simpleTransform(newTag, newAttributes, shouldMerge)
 The last parameter (`shouldMerge`) is set to `true` by default. When `true`, `simpleTransform` will merge the current attributes with the new ones (`newAttributes`). When `false`, all existing attributes are discarded.
+You can also add or modify the text contents of a tag:
+```js
+clean = sanitizeHtml(dirty, {
+  transformTags: {
+    'a': function(tagName, attribs) {
+        return {
+            tagName: 'a',
+            text: 'Some text'
+        };
+    }
+  }
+});
+```
+For example, you could transform a link element with missing anchor text:
+```js
+<a href="http://somelink.com"></a>
+```
+To a link with anchor text:
+```js
+<a href="http://somelink.com">Some text</a>
+```
 ### Filters
 You can provide a filter function to remove unwanted tags. Let's suppose we need to remove empty `a` tags like:
@@ -279,6 +340,12 @@ allowedSchemesByTag: {
 }
 ```
+And you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:
+```javascript
+allowProtocolRelative: false
+```
 ### Discarding the entire contents of a disallowed tag
 Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.
@@ -299,6 +366,14 @@ The content still gets escaped properly, with the exception of the `script` and
 ## Changelog
+1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.
+1.14.0: the new `allowProtocolRelative` option, which is set to `true` by default, allows you to decline to accept URLs that start with `//` and thus point to a different host using the current protocol. If you do **not** want to permit this, set this option to `false`. This is fully backwards compatible because the default behavior is to allow them. Thanks to Luke Bernard.
+1.13.0: `transformTags` can now add text to an element that initially had none. Thanks to Dushyant Singh.
+1.12.0: option to build for browser-side use. Thanks to Michael Blum.
 1.11.4: fixed crash when `__proto__` is a tag name. Now using a safe check for the existence of properties in all cases. Thanks to Andrew Krasichkov.
 Fixed XSS attack vector via `textarea` tags (when explicitly allowed). Decided that `script` (obviously) and `style` (due to its own XSS vectors) cannot realistically be afforded any XSS protection if allowed, unless we add a full CSS parser. Thanks again to Andrew Krasichkov.
@@ -402,5 +477,3 @@ We're rocking our tests and have been working great in production for months, so
 Feel free to open issues on [github](http://github.com/punkave/sanitize-html).
 <a href="http://punkave.com/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-builtby.png" /></a>

package/index.js CHANGED Viewed

@@ -118,6 +118,7 @@ function sanitizeHtml(html, options, _recursing) {
       stack.push(frame);
       var skip = false;
+      var hasText = frame.text ? true : false;
       var transformedTag;
       if (has(transformTagsMap, name)) {
         transformedTag = transformTagsMap[name](name, attribs);
@@ -190,6 +191,9 @@ function sanitizeHtml(html, options, _recursing) {
         result += " />";
       } else {
         result += ">";
+        if (frame.innerText && !hasText && !options.textFilter) {
+          result += frame.innerText;
+        }
       }
     },
     ontext: function(text) {
@@ -292,7 +296,12 @@ function sanitizeHtml(html, options, _recursing) {
     // Case insensitive so we don't get faked out by JAVASCRIPT #1
     var matches = href.match(/^([a-zA-Z]+)\:/);
     if (!matches) {
-      // No scheme = no way to inject js (right?)
+      // Protocol-relative URL: "//some.evil.com/nasty"
+      if (href.match(/^\/\//)) {
+        return !options.allowProtocolRelative;
+      }
+      // No scheme
       return false;
     }
     var scheme = matches[1].toLowerCase();
@@ -336,7 +345,8 @@ sanitizeHtml.defaults = {
   selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
   // URL schemes we permit
   allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
-  allowedSchemesByTag: {}
+  allowedSchemesByTag: {},
+  allowProtocolRelative: true
 };
 sanitizeHtml.simpleTransform = function(newTagName, newAttribs, merge) {

package/package.json CHANGED Viewed

@@ -1,10 +1,13 @@
 {
   "name": "sanitize-html",
-  "version": "1.11.4",
+  "version": "1.14.1",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "main": "index.js",
   "scripts": {
-    "test": "mocha test/test.js"
+    "build": "browserify index.js > dist/sanitize-html.js --standalone 'sanitizeHtml'",
+    "minify": "npm run build && uglifyjs dist/sanitize-html.js > dist/sanitize-html.min.js",
+    "test": "mocha test/test.js",
+    "prebuild": "npm run test && rm -rf dist && mkdir dist"
   },
   "repository": {
     "type": "git",
@@ -24,5 +27,10 @@
     "htmlparser2": "^3.9.0",
     "regexp-quote": "0.0.0",
     "xtend": "^4.0.0"
+  },
+  "devDependencies": {
+    "browserify": "^13.0.1",
+    "mocha": "^2.5.3",
+    "uglify-js": "^2.6.2"
   }
 }

package/test/test.js CHANGED Viewed

@@ -144,6 +144,25 @@ describe('sanitizeHtml', function() {
     }}), '<a href="http://somelink">some_text_need&quot;to&lt;be&gt;filtered</a>');
   });
+  it('should add new text when not initially set and replace attributes when they are changed by transforming function', function () {
+    assert.equal(sanitizeHtml('<a href="http://somelink"></a>', { transformTags: {a: function (tagName, attribs) {
+      return {
+        tagName: tagName,
+        attribs: attribs,
+        text: 'some new text'
+      }
+    }}}), '<a href="http://somelink">some new text</a>');
+  });
+  it('should preserve text when initially set and replace attributes when they are changed by transforming function', function () {
+    assert.equal(sanitizeHtml('<a href="http://somelink">some initial text</a>', { transformTags: {a: function (tagName, attribs) {
+      return {
+        tagName: tagName,
+        attribs: attribs
+      }
+    }}}), '<a href="http://somelink">some initial text</a>');
+  });
   it('should skip an empty link', function() {
      assert.strictEqual(
      sanitizeHtml('<p>This is <a href="http://www.linux.org"></a><br/>Linux</p>', {
@@ -495,4 +514,22 @@ describe('sanitizeHtml', function() {
       ), '!<textarea>&lt;/textarea&gt;&lt;svg/onload=prompt`xs`&gt;</textarea>!'
     );
   });
+  it('should allow protocol relative links by default', function() {
+    assert.equal(
+      sanitizeHtml('<a href="//cnn.com/example">test</a>'),
+      '<a href="//cnn.com/example">test</a>'
+    );
+  });
+  it('should not allow protocol relative links when allowProtocolRelative is false', function() {
+    assert.equal(
+      sanitizeHtml('<a href="//cnn.com/example">test</a>', { allowProtocolRelative: false }),
+      '<a>test</a>'
+    );
+  });
+  it('should still allow regular relative URLs when allowProtocolRelative is false', function() {
+    assert.equal(
+      sanitizeHtml('<a href="/welcome">test</a>', { allowProtocolRelative: false }),
+      '<a href="/welcome">test</a>'
+    );
+  });
 });