sanitize-html 1.13.0 → 1.14.3

package/README.md

@@ -114,7 +114,8 @@ allowedAttributes: {
 selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
 // URL schemes we permit
 allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
-allowedSchemesByTag: {}
+allowedSchemesByTag: {},
+allowProtocolRelative: true
 ```
 
 #### "What if I want to allow all tags or all attributes?"
@@ -339,6 +340,12 @@ allowedSchemesByTag: {
 }
 ```
 
+And you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:
+
+```javascript
+allowProtocolRelative: false
+```
+
 ### Discarding the entire contents of a disallowed tag
 
 Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.
@@ -359,6 +366,11 @@ The content still gets escaped properly, with the exception of the `script` and
 
 ## Changelog
 
+1.14.3: inadvertent removal of lodash regexp quote dependency in 1.14.2 has been corrected.
+1.14.2: protocol-relative URL detection must spot URLs starting with `\\` rather than `//` due to ages-old tolerance features of web browsers, intended for sleepy Windows developers. Thanks to Martin Bajanik.
+1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.  
+1.14.0: the new `allowProtocolRelative` option, which is set to `true` by default, allows you to decline to accept URLs that start with `//` and thus point to a different host using the current protocol. If you do **not** want to permit this, set this option to `false`. This is fully backwards compatible because the default behavior is to allow them. Thanks to Luke Bernard.
+
 1.13.0: `transformTags` can now add text to an element that initially had none. Thanks to Dushyant Singh.
 
 1.12.0: option to build for browser-side use. Thanks to Michael Blum.

package/index.js

@@ -1,6 +1,6 @@
 var htmlparser = require('htmlparser2');
 var extend = require('xtend');
-var quoteRegexp = require('regexp-quote');
+var quoteRegexp = require('lodash.escaperegexp');
 
 function each(obj, cb) {
   if (obj) Object.keys(obj).forEach(function (key) {
@@ -296,7 +296,12 @@ function sanitizeHtml(html, options, _recursing) {
     // Case insensitive so we don't get faked out by JAVASCRIPT #1
     var matches = href.match(/^([a-zA-Z]+)\:/);
     if (!matches) {
-      // No scheme = no way to inject js (right?)
+      // Protocol-relative URL starting with any combination of '/' and '\'
+      if (href.match(/^[\/\\]{2}/)) {
+        return !options.allowProtocolRelative;
+      }
+
+      // No scheme
       return false;
     }
     var scheme = matches[1].toLowerCase();
@@ -340,7 +345,8 @@ sanitizeHtml.defaults = {
   selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
   // URL schemes we permit
   allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
-  allowedSchemesByTag: {}
+  allowedSchemesByTag: {},
+  allowProtocolRelative: true
 };
 
 sanitizeHtml.simpleTransform = function(newTagName, newAttribs, merge) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "1.13.0",
+  "version": "1.14.3",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "main": "index.js",
   "scripts": {
@@ -25,7 +25,7 @@
   "license": "MIT",
   "dependencies": {
     "htmlparser2": "^3.9.0",
-    "regexp-quote": "0.0.0",
+    "lodash.escaperegexp": "^4.1.2",
     "xtend": "^4.0.0"
   },
   "devDependencies": {

package/test/test.js

@@ -514,4 +514,34 @@ describe('sanitizeHtml', function() {
       ), '!<textarea>&lt;/textarea&gt;&lt;svg/onload=prompt`xs`&gt;</textarea>!'
     );
   });
+  it('should allow protocol relative links by default', function() {
+    assert.equal(
+      sanitizeHtml('<a href="//cnn.com/example">test</a>'),
+      '<a href="//cnn.com/example">test</a>'
+    );
+  });
+  it('should not allow protocol relative links when allowProtocolRelative is false', function() {
+    assert.equal(
+      sanitizeHtml('<a href="//cnn.com/example">test</a>', { allowProtocolRelative: false }),
+      '<a>test</a>'
+    );
+    assert.equal(
+      sanitizeHtml('<a href="/\\cnn.com/example">test</a>', { allowProtocolRelative: false }),
+      '<a>test</a>'
+    );
+    assert.equal(
+      sanitizeHtml('<a href="\\\\cnn.com/example">test</a>', { allowProtocolRelative: false }),
+      '<a>test</a>'
+    );
+    assert.equal(
+      sanitizeHtml('<a href="\\/cnn.com/example">test</a>', { allowProtocolRelative: false }),
+      '<a>test</a>'
+    );
+  });
+  it('should still allow regular relative URLs when allowProtocolRelative is false', function() {
+    assert.equal(
+      sanitizeHtml('<a href="/welcome">test</a>', { allowProtocolRelative: false }),
+      '<a href="/welcome">test</a>'
+    );
+  });
 });

package/.npmignore

@@ -1,6 +0,0 @@
-npm-debug.log
-*.DS_Store
-node_modules
-dist
-# We do not commit CSS, only LESS
-public/css/*.css