sanitize-html 1.14.0 → 1.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -114,7 +114,8 @@ allowedAttributes: {
|
|
|
114
114
|
selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
|
|
115
115
|
// URL schemes we permit
|
|
116
116
|
allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
|
|
117
|
-
allowedSchemesByTag: {}
|
|
117
|
+
allowedSchemesByTag: {},
|
|
118
|
+
allowProtocolRelative: true
|
|
118
119
|
```
|
|
119
120
|
|
|
120
121
|
#### "What if I want to allow all tags or all attributes?"
|
|
@@ -339,6 +340,12 @@ allowedSchemesByTag: {
|
|
|
339
340
|
}
|
|
340
341
|
```
|
|
341
342
|
|
|
343
|
+
And you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:
|
|
344
|
+
|
|
345
|
+
```javascript
|
|
346
|
+
allowProtocolRelative: false
|
|
347
|
+
```
|
|
348
|
+
|
|
342
349
|
### Discarding the entire contents of a disallowed tag
|
|
343
350
|
|
|
344
351
|
Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.
|
|
@@ -359,6 +366,8 @@ The content still gets escaped properly, with the exception of the `script` and
|
|
|
359
366
|
|
|
360
367
|
## Changelog
|
|
361
368
|
|
|
369
|
+
1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.
|
|
370
|
+
|
|
362
371
|
1.14.0: the new `allowProtocolRelative` option, which is set to `true` by default, allows you to decline to accept URLs that start with `//` and thus point to a different host using the current protocol. If you do **not** want to permit this, set this option to `false`. This is fully backwards compatible because the default behavior is to allow them. Thanks to Luke Bernard.
|
|
363
372
|
|
|
364
373
|
1.13.0: `transformTags` can now add text to an element that initially had none. Thanks to Dushyant Singh.
|
package/package.json
CHANGED