sanitize-html 1.16.3 → 1.18.2

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "sanitize-html",
-  "version": "1.16.3",
+  "version": "1.18.2",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "main": "dist/index.js",
   "scripts": {
     "prepare": "true",
     "build": "make clean && make all && npm run prepare && browserify dist/index.js > dist/sanitize-html.js --standalone 'sanitizeHtml'",
     "minify": "npm run build && uglifyjs dist/sanitize-html.js > dist/sanitize-html.min.js",
-    "prepublish": "make clean && npm run minify",
-    "test": "npm run prepublish && mocha test/test.js"
+    "prepublishOnly": "make clean && npm run minify",
+    "test": "npm run prepublishOnly && mocha test/test.js"
   },
   "repository": {
     "type": "git",
@@ -25,9 +25,12 @@
   "author": "P'unk Avenue LLC",
   "license": "MIT",
   "dependencies": {
+    "chalk": "^2.3.0",
     "htmlparser2": "^3.9.0",
     "lodash.clonedeep": "^4.5.0",
     "lodash.escaperegexp": "^4.1.2",
+    "lodash.isplainobject": "^4.0.6",
+    "lodash.isstring": "^4.0.1",
     "lodash.mergewith": "^4.6.0",
     "postcss": "^6.0.14",
     "srcset": "^1.0.0",

package/src/index.js

@@ -3,8 +3,11 @@ var extend = require('xtend');
 var quoteRegexp = require('lodash.escaperegexp');
 var cloneDeep = require('lodash.clonedeep');
 var mergeWith = require('lodash.mergewith');
+var isString = require('lodash.isstring');
+var isPlainObject = require('lodash.isplainobject');
 var srcset = require('srcset');
 var postcss = require('postcss');
+var url = require('url');
 
 function each(obj, cb) {
   if (obj) Object.keys(obj).forEach(function (key) {
@@ -90,11 +93,11 @@ function sanitizeHtml(html, options, _recursing) {
     each(options.allowedAttributes, function(attributes, tag) {
       allowedAttributesMap[tag] = [];
       var globRegex = [];
-      attributes.forEach(function(name) {
-        if(name.indexOf('*') >= 0) {
-          globRegex.push(quoteRegexp(name).replace(/\\\*/g, '.*'));
+      attributes.forEach(function(obj) {
+        if(isString(obj) && obj.indexOf('*') >= 0) {
+          globRegex.push(quoteRegexp(obj).replace(/\\\*/g, '.*'));
         } else {
-          allowedAttributesMap[tag].push(name);
+          allowedAttributesMap[tag].push(obj);
         }
       });
       allowedAttributesGlobMap[tag] = new RegExp('^(' + globRegex.join('|') + ')$');
@@ -195,21 +198,73 @@ function sanitizeHtml(html, options, _recursing) {
             return;
           }
           var parsed;
+          // check allowedAttributesMap for the element and attribute and modify the value
+          // as necessary if there are specific values defined.
+          var passedAllowedAttributesMapCheck = false;
           if (!allowedAttributesMap ||
-              (has(allowedAttributesMap, name) && allowedAttributesMap[name].indexOf(a) !== -1 ) ||
-              (allowedAttributesMap['*'] && allowedAttributesMap['*'].indexOf(a) !== -1 ) ||
-              (has(allowedAttributesGlobMap, name) && allowedAttributesGlobMap[name].test(a)) ||
-              (allowedAttributesGlobMap['*'] && allowedAttributesGlobMap['*'].test(a))) {
-            if ((a === 'href') || (a === 'src')) {
+            (has(allowedAttributesMap, name) && allowedAttributesMap[name].indexOf(a) !== -1 ) ||
+            (allowedAttributesMap['*'] && allowedAttributesMap['*'].indexOf(a) !== -1 ) ||
+            (has(allowedAttributesGlobMap, name) && allowedAttributesGlobMap[name].test(a)) ||
+            (allowedAttributesGlobMap['*'] && allowedAttributesGlobMap['*'].test(a))) {    
+              passedAllowedAttributesMapCheck = true;
+          } else if (allowedAttributesMap && allowedAttributesMap[name]) {
+            for (const o of allowedAttributesMap[name]) {
+              if (isPlainObject(o) && o.name && (o.name === a)) {
+                passedAllowedAttributesMapCheck = true;
+                var newValue = '';
+                if (o.multiple === true) {
+                  // verify the values that are allowed
+                  const splitStrArray = value.split(' ');
+                  for (const s of splitStrArray) {
+                    if (o.values.indexOf(s) !== -1) {
+                      if (newValue === '') {
+                        newValue = s;
+                      } else {
+                        newValue += ' ' + s;
+                      }
+                    }
+                  }
+                } else if (o.values.indexOf(value) >= 0) {
+                  // verified an allowed value matches the entire attribute value
+                  newValue = value;
+                }
+                value = newValue;
+              }
+            }
+          }
+          if (passedAllowedAttributesMapCheck) {
+            if (options.allowedSchemesAppliedToAttributes.indexOf(a) !== -1) {
               if (naughtyHref(name, value)) {
                 delete frame.attribs[a];
                 return;
               }
             }
-
+            if (name === 'iframe' && a === 'src') {
+              //Check if value contains proper hostname prefix
+              if (value.substring(0, 2) === '//') {
+                var prefix = 'https:';
+                value = prefix.concat(value);            
+              }
+              try {
+                parsed = url.parse(value);
+                if (options.allowedIframeHostnames) {
+                  var whitelistedHostnames = options.allowedIframeHostnames.find(function(hostname) {
+                    return hostname === parsed.hostname;
+                  });
+                  if (!whitelistedHostnames) {
+                    delete frame.attribs[a];
+                    return;
+                  }
+                }
+              } catch (e) {
+                // Unparseable iframe src
+                delete frame.attribs[a];
+                return;
+              }
+            } 
             if (a === 'srcset') {
               try {
-                var parsed = srcset.parse(value);
+                parsed = srcset.parse(value);
                 each(parsed, function(value) {
                   if (naughtyHref('srcset', value.url)) {
                     value.evil = true;
@@ -233,7 +288,6 @@ function sanitizeHtml(html, options, _recursing) {
                 return;
               }
             }
-
             if (a === 'class') {
               value = filterClasses(value, allowedClassesMap[name]);
               if (!value.length) {
@@ -498,7 +552,7 @@ var htmlParserDefaults = {
 sanitizeHtml.defaults = {
   allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
     'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
-    'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre' ],
+    'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe' ],
   allowedAttributes: {
     a: [ 'href', 'name', 'target' ],
     // We don't currently allow img itself by default, but this
@@ -511,6 +565,7 @@ sanitizeHtml.defaults = {
   // URL schemes we permit
   allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
   allowedSchemesByTag: {},
+  allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
   allowProtocolRelative: true
 };
 

package/test/test.js

@@ -647,4 +647,79 @@ describe('sanitizeHtml', function() {
       }), '<span style="color:yellow;text-align:center;font-family:helvetica;"></span>'
     );
   });
+  it('Should allow only hostnames in an iframe that are whitelisted', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+      }), '<iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>'
+    );
+  });
+  it('Should remove iframe src urls that are not inlcuded in whitelisted hostnames', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="https://www.embed.vevo.com/USUV71704255"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+      }), '<iframe></iframe>'
+    );
+  });
+  it('Should not allow iframe urls that do not have proper hostname', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="//www.vimeo.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+      }), '<iframe></iframe>'
+    );
+  });
+  it('Should allow iframe through if no hostname option is set', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="https://www.vimeo.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']}
+      }), '<iframe src="https://www.vimeo.com/embed/c2IlcS7AHxM"></iframe>'
+    );
+  });
+  it('Should only allow attributes to have any combination of specific values', function() {
+    assert.equal(
+      sanitizeHtml('<iframe name=\"IFRAME\" allowfullscreen=\"true\" sandbox=\"allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-top-navigation\"></iframe>',{
+        allowedTags: sanitizeHtml.defaults.allowedTags.concat( ['iframe'] ),
+        allowedAttributes: {
+          iframe: [ 
+            {
+              name: 'sandbox',
+              multiple: true,
+              values: ['allow-popups', 'allow-same-origin', 'allow-scripts']
+            },
+            'allowfullscreen'
+          ]
+        }
+      }), '<iframe allowfullscreen=\"true\" sandbox=\"allow-popups allow-same-origin allow-scripts\"></iframe>');
+  });
+  it('Should only allow attributes that match a specific value', function() {
+    assert.equal(
+      sanitizeHtml('<iframe sandbox=\"allow-popups allow-modals\"></iframe><iframe sandbox=\"allow-popups\"></iframe><iframe sandbox=\"allow-scripts\"></iframe>',{
+        allowedTags: sanitizeHtml.defaults.allowedTags.concat( ['iframe'] ),
+        allowedAttributes: {
+          iframe: [ 
+            {
+              name: 'sandbox',
+              multiple: false,
+              values: ['allow-popups', 'allow-same-origin', 'allow-scripts']
+            }
+          ]
+        }
+      }), '<iframe sandbox></iframe><iframe sandbox=\"allow-popups\"></iframe><iframe sandbox=\"allow-scripts\"></iframe>');
+    }
+  );
+  it('Should not allow cite urls that do not have an allowed scheme', function() {
+    assert.equal(
+      sanitizeHtml('<q cite=\"http://www.google.com\">HTTP</q><q cite=\"https://www.google.com\">HTTPS</q><q cite=\"mailto://www.google.com\">MAILTO</q><q cite=\"tel://www.google.com\">TEL</q><q cite=\"ftp://www.google.com\">FTP</q><q cite=\"data://www.google.com\">DATA</q><q cite=\"ldap://www.google.com\">LDAP</q><q cite=\"acrobat://www.google.com\">ACROBAT</q><q cite=\"vbscript://www.google.com\">VBSCRIPT</q><q cite=\"file://www.google.com\">FILE</q><q cite=\"rlogin://www.google.com\">RLOGIN</q><q cite=\"webcal://www.google.com\">WEBCAL</q><q cite=\"javascript://www.google.com\">JAVASCRIPT</q><q cite=\"mms://www.google.com\">MMS</q>',{
+        allowedTags: sanitizeHtml.defaults.allowedTags.concat( ['q'] ),
+        allowedAttributes: {q: [ 'cite' ]},
+        allowedSchemes: sanitizeHtml.defaults.allowedSchemes.concat([ 'tel' ]),
+      }), '<q cite=\"http://www.google.com\">HTTP</q><q cite=\"https://www.google.com\">HTTPS</q><q cite=\"mailto://www.google.com\">MAILTO</q><q cite=\"tel://www.google.com\">TEL</q><q cite=\"ftp://www.google.com\">FTP</q><q>DATA</q><q>LDAP</q><q>ACROBAT</q><q>VBSCRIPT</q><q>FILE</q><q>RLOGIN</q><q>WEBCAL</q><q>JAVASCRIPT</q><q>MMS</q>');
+  });
 });