sanitize-html 1.18.1 → 1.18.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "1.18.1",
+  "version": "1.18.5",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "main": "dist/index.js",
   "scripts": {

package/src/index.js

@@ -4,7 +4,7 @@ var quoteRegexp = require('lodash.escaperegexp');
 var cloneDeep = require('lodash.clonedeep');
 var mergeWith = require('lodash.mergewith');
 var isString = require('lodash.isstring');
-var isPlainObject = require('lodash.isPlainObject');
+var isPlainObject = require('lodash.isplainobject');
 var srcset = require('srcset');
 var postcss = require('postcss');
 var url = require('url');
@@ -240,13 +240,10 @@ function sanitizeHtml(html, options, _recursing) {
               }
             }
             if (name === 'iframe' && a === 'src') {
-              //Check if value contains proper hostname prefix
-              if (value.substring(0, 2) === '//') {
-                var prefix = 'https:';
-                value = prefix.concat(value);            
-              }
               try {
-                parsed = url.parse(value);
+                // naughtyHref is in charge of whether protocol relative URLs
+                // are cool. We should just accept them
+                parsed = url.parse(value, false, true);
                 if (options.allowedIframeHostnames) {
                   var whitelistedHostnames = options.allowedIframeHostnames.find(function(hostname) {
                     return hostname === parsed.hostname;
@@ -414,7 +411,10 @@ function sanitizeHtml(html, options, _recursing) {
     if (typeof(s) !== 'string') {
       s = s + '';
     }
-    return s.replace(/\&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
+    return s.replace(/&(?![a-zA-Z0-9#]{1,7};)/g, '&amp;') // Match ampersands not part of existing HTML entity
+      .replace(/</g, '&lt;')
+      .replace(/\>/g, '&gt;')
+      .replace(/\"/g, '&quot;');
   }
 
   function naughtyHref(name, href) {

package/test/test.js

@@ -647,7 +647,7 @@ describe('sanitizeHtml', function() {
       }), '<span style="color:yellow;text-align:center;font-family:helvetica;"></span>'
     );
   });
-  it('Should allow only hostnames in an iframe that are whitelisted', function() {
+  it('Should allow hostnames in an iframe that are whitelisted', function() {
     assert.equal(
       sanitizeHtml('<iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
         allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
@@ -667,7 +667,7 @@ describe('sanitizeHtml', function() {
   });
   it('Should not allow iframe urls that do not have proper hostname', function() {
     assert.equal(
-      sanitizeHtml('<iframe src="//www.vimeo.com/embed/c2IlcS7AHxM"></iframe>', {
+      sanitizeHtml('<iframe src="https://www.vimeo.com/embed/c2IlcS7AHxM"></iframe>', {
         allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
         allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
         allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
@@ -682,6 +682,32 @@ describe('sanitizeHtml', function() {
       }), '<iframe src="https://www.vimeo.com/embed/c2IlcS7AHxM"></iframe>'
     );
   });
+  it('Should allow relative URLs for iframes', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="/foo"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']}
+      }), '<iframe src="/foo"></iframe>'
+    );
+  });
+  it('Should allow protocol-relative URLs for the right domain for iframes', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="//www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+      }), '<iframe src="//www.youtube.com/embed/c2IlcS7AHxM"></iframe>'
+    );
+  });
+  it('Should not allow protocol-relative iframe urls that do not have proper hostname', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="//www.vimeo.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+      }), '<iframe></iframe>'
+    );
+  });
   it('Should only allow attributes to have any combination of specific values', function() {
     assert.equal(
       sanitizeHtml('<iframe name=\"IFRAME\" allowfullscreen=\"true\" sandbox=\"allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-top-navigation\"></iframe>',{
@@ -722,4 +748,17 @@ describe('sanitizeHtml', function() {
         allowedSchemes: sanitizeHtml.defaults.allowedSchemes.concat([ 'tel' ]),
       }), '<q cite=\"http://www.google.com\">HTTP</q><q cite=\"https://www.google.com\">HTTPS</q><q cite=\"mailto://www.google.com\">MAILTO</q><q cite=\"tel://www.google.com\">TEL</q><q cite=\"ftp://www.google.com\">FTP</q><q>DATA</q><q>LDAP</q><q>ACROBAT</q><q>VBSCRIPT</q><q>FILE</q><q>RLOGIN</q><q>WEBCAL</q><q>JAVASCRIPT</q><q>MMS</q>');
   });
+  it('Should encode &, <, > and "', function() {
+    assert.equal(sanitizeHtml('"< & >"'), '&quot;&lt; &amp; &gt;&quot;');
+  });
+  it('Should not double encode ampersands on HTML entities', function() {
+    var textIn = 'This &amp; & that &reg; &#x0000A; &#10; &plusmn; OK?';
+    var expectedResult = 'This &amp; &amp; that &reg; &#x0000A; &#10; &plusmn; OK?';
+    var sanitizeHtmlOptions = {
+      parser: {
+        decodeEntities: false
+      }
+    };
+    assert.equal(sanitizeHtml(textIn, sanitizeHtmlOptions), expectedResult);
+  });
 });