sanitize-html 1.16.3 → 1.18.2

package/.travis.yml

@@ -0,0 +1,5 @@
+language: node_js
+node_js:
+  - "stable"
+  - "lts/*"
+

package/README.md

@@ -14,6 +14,8 @@ The syntax of poorly closed `p` and `img` elements is cleaned up.
 
 `href` attributes are validated to ensure they only contain `http`, `https`, `ftp` and `mailto` URLs. Relative URLs are also allowed. Ditto for `src` attributes.
 
+Allowing particular urls as a `src` to an iframe tag by filtering hostnames is also supported. 
+
 HTML comments are not preserved.
 
 ## Requirements
@@ -82,7 +84,8 @@ clean = sanitizeHtml(dirty, {
   allowedTags: [ 'b', 'i', 'em', 'strong', 'a' ],
   allowedAttributes: {
     'a': [ 'href' ]
-  }
+  },
+  allowedIframeHostnames: ['www.youtube.com']
 });
 ```
 
@@ -115,7 +118,9 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
 // URL schemes we permit
 allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
 allowedSchemesByTag: {},
-allowProtocolRelative: true
+allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
+allowProtocolRelative: true,
+allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
 ```
 
 #### "What if I want to allow all tags or all attributes?"
@@ -137,6 +142,23 @@ allowedTags: [],
 allowedAttributes: []
 ```
 
+### "What if I want to allow only specific values on some attributes?"
+
+When configuring the attribute in `allowedAttributes` simply use an object with attribute `name` and an allowed `values` array. In the following example `sandbox="allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts"` would become `sandbox="allow-popups allow-scripts"`:
+
+```js
+        allowedAttributes: {
+          iframe: [ 
+            {
+              name: 'sandbox',
+              multiple: true,
+              values: ['allow-popups', 'allow-same-origin', 'allow-scripts']
+            }
+          ]
+```
+
+With `multiple: true`, several allowed values may appear in the same attribute, separated by spaces. Otherwise the attribute must exactly match one and only one of the allowed values.
+
 ### Wildcards for attributes
 
 You can use the `*` wildcard to allow all attributes with a certain prefix:
@@ -294,6 +316,61 @@ sanitizeHtml(
 
 Note that the text passed to the `textFilter` method is already escaped for safe display as HTML. You may add markup and use entity escape sequences in your `textFilter`.
 
+### Iframe Filters
+
+If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function. 
+
+This array will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe. 
+
+Make sure to pass a valid hostname along with the domain you wish to allow, i.e.: 
+
+```javascript
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+```
+
+**Remember that the `iframe` tag must be allowed as well as the `src` attribute.**
+
+For example:
+
+```javascript
+clean = sanitizeHtml('<p><iframe src="https://www.youtube.com/embed/nykIhs12345"></iframe><p>', {
+  allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
+  allowedClasses: {
+    'p': [ 'fancy', 'simple' ],
+    'iframe': ['src']
+  },
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+});
+```
+
+will pass through as safe whereas:
+
+```javascript
+clean = sanitizeHtml('<p><iframe src="https://www.youtube.net/embed/nykIhs12345"></iframe><p>', {
+  allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
+  allowedClasses: {
+    'p': [ 'fancy', 'simple' ],
+    'iframe': ['src']
+  },
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+});
+```
+
+or 
+
+```javascript
+clean = sanitizeHtml('<p><iframe src="https://www.vimeo/video/12345"></iframe><p>', {
+  allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
+  allowedClasses: {
+    'p': [ 'fancy', 'simple' ],
+    'iframe': ['src']
+  },
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+});
+```
+
+will return an empty iframe tag.
+
 ### Allowed CSS Classes
 
 If you wish to allow specific CSS classes on a particular element, you can do so with the `allowedClasses` option. Any other CSS classes are discarded.
@@ -397,6 +474,25 @@ The content still gets escaped properly, with the exception of the `script` and
 
 ## Changelog
 
+1.18.2:
+
+* Travis tests passing.
+* Fixed another case issue — and instituted Travis CI testing so this doesn't happen again. Sorry for the hassle.
+
+1.18.1:
+
+* A file was required with incorrect case, breaking the library on case sensitive filesystems such as Linux. Fixed.
+
+1.18.0:
+
+* The new `allowedSchemesAppliedToAttributes` option. This determines which attributes are validated as URLs, replacing the old hardcoded list of `src` and `href` only. The default list now includes `cite`. Thanks to ml-dublin for this contribution.
+
+* It is now easy to configure a specific list of allowed values for an attribute. When configuring `allowedAttributes`, rather than listing an attribute name, simply list an object with an attribute `name` property and an allowed `values` array property. You can also add `multiple: true` to allow multiple space-separated allowed values in the attribute, otherwise the attribute must match one and only one of the allowed values. Thanks again to ml-dublin for this contribution.
+
+* Fixed a bug in the npm test procedure.
+
+1.17.0: the new `allowedIframeHostnames` option. If present, this must be an array, and only iframe `src` URLs hostnames (complete hostnames; domain name matches are not enough) that appear on this list are allowed. You must also configure `hostname` as an allowed attribute for `iframe`. Thanks to Ryan Verys for this contribution.
+
 1.16.3: don't throw away the browserified versions before publishing them. `prepare` is not a good place to `make clean`, it runs after `prepublish`.
 
 1.16.2: `sanitize-html` is now compiled with `babel`. An npm `prepublish` script takes care of this at `npm publish` time, so the latest code should always be compiled to operate all the way back to ES5 browsers and earlier versions of Node. Thanks to Ayushya Jaiswal.

package/dist/index.js

@@ -5,8 +5,11 @@ var extend = require('xtend');
 var quoteRegexp = require('lodash.escaperegexp');
 var cloneDeep = require('lodash.clonedeep');
 var mergeWith = require('lodash.mergewith');
+var isString = require('lodash.isstring');
+var isPlainObject = require('lodash.isplainobject');
 var srcset = require('srcset');
 var postcss = require('postcss');
+var url = require('url');
 
 function each(obj, cb) {
   if (obj) Object.keys(obj).forEach(function (key) {
@@ -92,11 +95,11 @@ function sanitizeHtml(html, options, _recursing) {
     each(options.allowedAttributes, function (attributes, tag) {
       allowedAttributesMap[tag] = [];
       var globRegex = [];
-      attributes.forEach(function (name) {
-        if (name.indexOf('*') >= 0) {
-          globRegex.push(quoteRegexp(name).replace(/\\\*/g, '.*'));
+      attributes.forEach(function (obj) {
+        if (isString(obj) && obj.indexOf('*') >= 0) {
+          globRegex.push(quoteRegexp(obj).replace(/\\\*/g, '.*'));
         } else {
-          allowedAttributesMap[tag].push(name);
+          allowedAttributesMap[tag].push(obj);
         }
       });
       allowedAttributesGlobMap[tag] = new RegExp('^(' + globRegex.join('|') + ')$');
@@ -197,17 +200,111 @@ function sanitizeHtml(html, options, _recursing) {
             return;
           }
           var parsed;
+          // check allowedAttributesMap for the element and attribute and modify the value
+          // as necessary if there are specific values defined.
+          var passedAllowedAttributesMapCheck = false;
           if (!allowedAttributesMap || has(allowedAttributesMap, name) && allowedAttributesMap[name].indexOf(a) !== -1 || allowedAttributesMap['*'] && allowedAttributesMap['*'].indexOf(a) !== -1 || has(allowedAttributesGlobMap, name) && allowedAttributesGlobMap[name].test(a) || allowedAttributesGlobMap['*'] && allowedAttributesGlobMap['*'].test(a)) {
-            if (a === 'href' || a === 'src') {
+            passedAllowedAttributesMapCheck = true;
+          } else if (allowedAttributesMap && allowedAttributesMap[name]) {
+            var _iteratorNormalCompletion = true;
+            var _didIteratorError = false;
+            var _iteratorError = undefined;
+
+            try {
+              for (var _iterator = allowedAttributesMap[name][Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true) {
+                var o = _step.value;
+
+                if (isPlainObject(o) && o.name && o.name === a) {
+                  passedAllowedAttributesMapCheck = true;
+                  var newValue = '';
+                  if (o.multiple === true) {
+                    // verify the values that are allowed
+                    var splitStrArray = value.split(' ');
+                    var _iteratorNormalCompletion2 = true;
+                    var _didIteratorError2 = false;
+                    var _iteratorError2 = undefined;
+
+                    try {
+                      for (var _iterator2 = splitStrArray[Symbol.iterator](), _step2; !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true) {
+                        var s = _step2.value;
+
+                        if (o.values.indexOf(s) !== -1) {
+                          if (newValue === '') {
+                            newValue = s;
+                          } else {
+                            newValue += ' ' + s;
+                          }
+                        }
+                      }
+                    } catch (err) {
+                      _didIteratorError2 = true;
+                      _iteratorError2 = err;
+                    } finally {
+                      try {
+                        if (!_iteratorNormalCompletion2 && _iterator2.return) {
+                          _iterator2.return();
+                        }
+                      } finally {
+                        if (_didIteratorError2) {
+                          throw _iteratorError2;
+                        }
+                      }
+                    }
+                  } else if (o.values.indexOf(value) >= 0) {
+                    // verified an allowed value matches the entire attribute value
+                    newValue = value;
+                  }
+                  value = newValue;
+                }
+              }
+            } catch (err) {
+              _didIteratorError = true;
+              _iteratorError = err;
+            } finally {
+              try {
+                if (!_iteratorNormalCompletion && _iterator.return) {
+                  _iterator.return();
+                }
+              } finally {
+                if (_didIteratorError) {
+                  throw _iteratorError;
+                }
+              }
+            }
+          }
+          if (passedAllowedAttributesMapCheck) {
+            if (options.allowedSchemesAppliedToAttributes.indexOf(a) !== -1) {
               if (naughtyHref(name, value)) {
                 delete frame.attribs[a];
                 return;
               }
             }
-
+            if (name === 'iframe' && a === 'src') {
+              //Check if value contains proper hostname prefix
+              if (value.substring(0, 2) === '//') {
+                var prefix = 'https:';
+                value = prefix.concat(value);
+              }
+              try {
+                parsed = url.parse(value);
+                if (options.allowedIframeHostnames) {
+                  var whitelistedHostnames = options.allowedIframeHostnames.find(function (hostname) {
+                    return hostname === parsed.hostname;
+                  });
+                  if (!whitelistedHostnames) {
+                    delete frame.attribs[a];
+                    return;
+                  }
+                }
+              } catch (e) {
+                // Unparseable iframe src
+                delete frame.attribs[a];
+                return;
+              }
+            }
             if (a === 'srcset') {
               try {
-                var parsed = srcset.parse(value);
+                parsed = srcset.parse(value);
                 each(parsed, function (value) {
                   if (naughtyHref('srcset', value.url)) {
                     value.evil = true;
@@ -231,7 +328,6 @@ function sanitizeHtml(html, options, _recursing) {
                 return;
               }
             }
-
             if (a === 'class') {
               value = filterClasses(value, allowedClassesMap[name]);
               if (!value.length) {
@@ -486,7 +582,7 @@ var htmlParserDefaults = {
   decodeEntities: true
 };
 sanitizeHtml.defaults = {
-  allowedTags: ['h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol', 'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div', 'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre'],
+  allowedTags: ['h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol', 'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div', 'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe'],
   allowedAttributes: {
     a: ['href', 'name', 'target'],
     // We don't currently allow img itself by default, but this
@@ -499,6 +595,7 @@ sanitizeHtml.defaults = {
   // URL schemes we permit
   allowedSchemes: ['http', 'https', 'ftp', 'mailto'],
   allowedSchemesByTag: {},
+  allowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],
   allowProtocolRelative: true
 };