sanitize-html 1.18.1 → 1.18.5

package/.travis.yml

@@ -0,0 +1,5 @@
+language: node_js
+node_js:
+  - "stable"
+  - "lts/*"
+

package/README.md

@@ -14,7 +14,7 @@ The syntax of poorly closed `p` and `img` elements is cleaned up.
 
 `href` attributes are validated to ensure they only contain `http`, `https`, `ftp` and `mailto` URLs. Relative URLs are also allowed. Ditto for `src` attributes.
 
-Allowing particular urls as a `src` to an iframe tag by filtering hostnames is also supported. 
+Allowing particular urls as a `src` to an iframe tag by filtering hostnames is also supported.
 
 HTML comments are not preserved.
 
@@ -106,7 +106,7 @@ If you do not specify `allowedTags` or `allowedAttributes` our default list is a
 ```js
 allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
   'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
-  'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre' ],
+  'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe' ],
 allowedAttributes: {
   a: [ 'href', 'name', 'target' ],
   // We don't currently allow img itself by default, but this
@@ -148,7 +148,7 @@ When configuring the attribute in `allowedAttributes` simply use an object with
 
 ```js
         allowedAttributes: {
-          iframe: [ 
+          iframe: [
             {
               name: 'sandbox',
               multiple: true,
@@ -318,11 +318,11 @@ Note that the text passed to the `textFilter` method is already escaped for safe
 
 ### Iframe Filters
 
-If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function. 
+If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function.
 
-This array will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe. 
+This array will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe.
 
-Make sure to pass a valid hostname along with the domain you wish to allow, i.e.: 
+Make sure to pass a valid hostname along with the domain you wish to allow, i.e.:
 
 ```javascript
   allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
@@ -337,6 +337,8 @@ clean = sanitizeHtml('<p><iframe src="https://www.youtube.com/embed/nykIhs12345"
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
     'p': [ 'fancy', 'simple' ],
+  },
+  allowedAttributes: {
     'iframe': ['src']
   },
   allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
@@ -350,19 +352,23 @@ clean = sanitizeHtml('<p><iframe src="https://www.youtube.net/embed/nykIhs12345"
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
     'p': [ 'fancy', 'simple' ],
+  },
+  allowedAttributes: {
     'iframe': ['src']
   },
   allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
 });
 ```
 
-or 
+or
 
 ```javascript
 clean = sanitizeHtml('<p><iframe src="https://www.vimeo/video/12345"></iframe><p>', {
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
     'p': [ 'fancy', 'simple' ],
+  },
+  allowedAttributes: {
     'iframe': ['src']
   },
   allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
@@ -409,7 +415,7 @@ clean = sanitizeHtml(dirty, {
             'color': [/^\#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/],
             'text-align': [/^left$/, /^right$/, /^center$/],
             // Match any number with px, em, or %
-            'font-size': [/^\d+$[px|em|\%]$/]
+            'font-size': [/^\d+(?:px|em|%)$/]
           },
           'p': {
             'font-size': [/^\d+rem$/]
@@ -474,6 +480,26 @@ The content still gets escaped properly, with the exception of the `script` and
 
 ## Changelog
 
+1.18.5:
+
+* Stop double encoding ampersands on HTML entities. Thanks to Will Gibson.
+
+1.18.4:
+
+* Removed incorrect `browser` key, restoring frontend build. Thanks to Felix Becker.
+
+1.18.3:
+
+* `iframe` is an allowed tag by default, to better facilitate typical use cases and the use of the `allowedIframeHostnames` option.
+* Documentation improvements.
+* More browser packaging improvements.
+* Protocol-relative URLs are properly supported for iframe tags.
+
+1.18.2:
+
+* Travis tests passing.
+* Fixed another case issue — and instituted Travis CI testing so this doesn't happen again. Sorry for the hassle.
+
 1.18.1:
 
 * A file was required with incorrect case, breaking the library on case sensitive filesystems such as Linux. Fixed.

package/dist/index.js

@@ -6,7 +6,7 @@ var quoteRegexp = require('lodash.escaperegexp');
 var cloneDeep = require('lodash.clonedeep');
 var mergeWith = require('lodash.mergewith');
 var isString = require('lodash.isstring');
-var isPlainObject = require('lodash.isPlainObject');
+var isPlainObject = require('lodash.isplainobject');
 var srcset = require('srcset');
 var postcss = require('postcss');
 var url = require('url');
@@ -280,13 +280,10 @@ function sanitizeHtml(html, options, _recursing) {
               }
             }
             if (name === 'iframe' && a === 'src') {
-              //Check if value contains proper hostname prefix
-              if (value.substring(0, 2) === '//') {
-                var prefix = 'https:';
-                value = prefix.concat(value);
-              }
               try {
-                parsed = url.parse(value);
+                // naughtyHref is in charge of whether protocol relative URLs
+                // are cool. We should just accept them
+                parsed = url.parse(value, false, true);
                 if (options.allowedIframeHostnames) {
                   var whitelistedHostnames = options.allowedIframeHostnames.find(function (hostname) {
                     return hostname === parsed.hostname;
@@ -454,7 +451,8 @@ function sanitizeHtml(html, options, _recursing) {
     if (typeof s !== 'string') {
       s = s + '';
     }
-    return s.replace(/\&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
+    return s.replace(/&(?![a-zA-Z0-9#]{1,7};)/g, '&amp;') // Match ampersands not part of existing HTML entity
+    .replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
   }
 
   function naughtyHref(name, href) {

package/dist/sanitize-html.js

@@ -7,7 +7,7 @@ var quoteRegexp = require('lodash.escaperegexp');
 var cloneDeep = require('lodash.clonedeep');
 var mergeWith = require('lodash.mergewith');
 var isString = require('lodash.isstring');
-var isPlainObject = require('lodash.isPlainObject');
+var isPlainObject = require('lodash.isplainobject');
 var srcset = require('srcset');
 var postcss = require('postcss');
 var url = require('url');
@@ -281,13 +281,10 @@ function sanitizeHtml(html, options, _recursing) {
               }
             }
             if (name === 'iframe' && a === 'src') {
-              //Check if value contains proper hostname prefix
-              if (value.substring(0, 2) === '//') {
-                var prefix = 'https:';
-                value = prefix.concat(value);
-              }
               try {
-                parsed = url.parse(value);
+                // naughtyHref is in charge of whether protocol relative URLs
+                // are cool. We should just accept them
+                parsed = url.parse(value, false, true);
                 if (options.allowedIframeHostnames) {
                   var whitelistedHostnames = options.allowedIframeHostnames.find(function (hostname) {
                     return hostname === parsed.hostname;
@@ -455,7 +452,8 @@ function sanitizeHtml(html, options, _recursing) {
     if (typeof s !== 'string') {
       s = s + '';
     }
-    return s.replace(/\&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
+    return s.replace(/&(?![a-zA-Z0-9#]{1,7};)/g, '&amp;') // Match ampersands not part of existing HTML entity
+    .replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
   }
 
   function naughtyHref(name, href) {
@@ -620,7 +618,7 @@ sanitizeHtml.simpleTransform = function (newTagName, newAttribs, merge) {
     };
   };
 };
-},{"htmlparser2":36,"lodash.clonedeep":41,"lodash.escaperegexp":42,"lodash.isPlainObject":43,"lodash.isstring":44,"lodash.mergewith":45,"postcss":60,"srcset":91,"url":109,"xtend":112}],2:[function(require,module,exports){
+},{"htmlparser2":36,"lodash.clonedeep":41,"lodash.escaperegexp":42,"lodash.isplainobject":43,"lodash.isstring":44,"lodash.mergewith":45,"postcss":60,"srcset":91,"url":109,"xtend":112}],2:[function(require,module,exports){
 (function (global){
 'use strict';