sanitize-html 1.18.3 → 1.19.1

package/package.json

@@ -1,9 +1,8 @@
 {
   "name": "sanitize-html",
-  "version": "1.18.3",
+  "version": "1.19.1",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "main": "dist/index.js",
-  "browser": "dist/sanitize-html.js",
   "scripts": {
     "prepare": "true",
     "build": "make clean && make all && npm run prepare && browserify dist/index.js > dist/sanitize-html.js --standalone 'sanitizeHtml'",

package/src/index.js

@@ -240,21 +240,26 @@ function sanitizeHtml(html, options, _recursing) {
               }
             }
             if (name === 'iframe' && a === 'src') {
+              var allowed = true;
               try {
                 // naughtyHref is in charge of whether protocol relative URLs
                 // are cool. We should just accept them
                 parsed = url.parse(value, false, true);
-                if (options.allowedIframeHostnames) {
-                  var whitelistedHostnames = options.allowedIframeHostnames.find(function(hostname) {
+                var isRelativeUrl = parsed && parsed.host === null && parsed.protocol === null;
+                if (isRelativeUrl) {
+                  // default value of allowIframeRelativeUrls is true unless allowIframeHostnames specified
+                  allowed = has(options, "allowIframeRelativeUrls") ? 
+                    options.allowIframeRelativeUrls : !options.allowedIframeHostnames;
+                } else if (options.allowedIframeHostnames) {
+                  allowed = options.allowedIframeHostnames.find(function (hostname) {
                     return hostname === parsed.hostname;
                   });
-                  if (!whitelistedHostnames) {
-                    delete frame.attribs[a];
-                    return;
-                  }
                 }
               } catch (e) {
                 // Unparseable iframe src
+                allowed = false;
+              }
+              if (!allowed) {
                 delete frame.attribs[a];
                 return;
               }
@@ -310,7 +315,7 @@ function sanitizeHtml(html, options, _recursing) {
             }
             result += ' ' + a;
             if (value.length) {
-              result += '="' + escapeHtml(value) + '"';
+              result += '="' + escapeHtml(value, true) + '"';
             }
           } else {
             delete frame.attribs[a];
@@ -346,7 +351,7 @@ function sanitizeHtml(html, options, _recursing) {
         // which have their own collection of XSS vectors.
         result += text;
       } else {
-        var escaped = escapeHtml(text);
+        var escaped = escapeHtml(text, false);
         if (options.textFilter) {
           result += options.textFilter(escaped);
         } else {
@@ -407,11 +412,28 @@ function sanitizeHtml(html, options, _recursing) {
 
   return result;
 
-  function escapeHtml(s) {
+  function escapeHtml(s, quote) {
     if (typeof(s) !== 'string') {
       s = s + '';
     }
-    return s.replace(/\&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
+    if (options.parser.decodeEntities) {
+      s = s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;');
+      if (quote) {
+        s = s.replace(/\"/g, '&quot;');
+      }
+    }
+    // TODO: this is inadequate because it will pass `&0;`. This approach
+    // will not work, each & must be considered with regard to whether it
+    // is followed by a 100% syntactically valid entity or not, and escaped
+    // if it is not. If this bothers you, don't set parser.decodeEntities
+    // to false. (The default is true.)
+    s = s.replace(/&(?![a-zA-Z0-9#]{1,20};)/g, '&amp;') // Match ampersands not part of existing HTML entity
+      .replace(/</g, '&lt;')
+      .replace(/\>/g, '&gt;');
+    if (quote) {
+      s = s.replace(/\"/g, '&quot;');
+    }
+    return s;
   }
 
   function naughtyHref(name, href) {

package/test/test.js

@@ -141,7 +141,7 @@ describe('sanitizeHtml', function() {
       }
     }}, textFilter: function (text) {
       return text.replace(/\s/g, '_');
-    }}), '<a href="http://somelink">some_text_need&quot;to&lt;be&gt;filtered</a>');
+    }}), '<a href="http://somelink">some_text_need"to&lt;be&gt;filtered</a>');
   });
 
   it('should add new text when not initially set and replace attributes when they are changed by transforming function', function () {
@@ -422,12 +422,12 @@ describe('sanitizeHtml', function() {
     assert.equal(
       sanitizeHtml('<<img src="javascript:evil"/>img src="javascript:evil"/>'
       ),
-      '&lt;img src=&quot;javascript:evil&quot;/&gt;'
+      '&lt;img src="javascript:evil"/&gt;'
     );
     assert.equal(
       sanitizeHtml('<<a href="javascript:evil"/>a href="javascript:evil"/>'
       ),
-      '&lt;<a>a href=&quot;javascript:evil&quot;/&gt;</a>'
+      '&lt;<a>a href="javascript:evil"/&gt;</a>'
     );
   });
   it('should allow attributes to be specified as globs', function() {
@@ -456,12 +456,12 @@ describe('sanitizeHtml', function() {
     assert.equal(
       sanitizeHtml('<div>"normal text"</div><script>"this is code"</script>', {
         allowedTags: [ 'script' ]
-      }), '&quot;normal text&quot;<script>"this is code"</script>'
+      }), '"normal text"<script>"this is code"</script>'
     );
     assert.equal(
       sanitizeHtml('<div>"normal text"</div><style>body { background-image: url("image.test"); }</style>', {
         allowedTags: [ 'style' ]
-      }), '&quot;normal text&quot;<style>body { background-image: url("image.test"); }</style>'
+      }), '"normal text"<style>body { background-image: url("image.test"); }</style>'
     );
   });
   it('should not unescape escapes found inside script tags', function() {
@@ -480,7 +480,7 @@ describe('sanitizeHtml', function() {
         textFilter: function(text) {
           return text.replace(' this should be removed', '');
         }
-      }), '&quot;normal text&quot;'
+      }), '"normal text"'
     );
   });
   it('should respect htmlparser2 options when passed in', function() {
@@ -656,7 +656,7 @@ describe('sanitizeHtml', function() {
       }), '<iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>'
     );
   });
-  it('Should remove iframe src urls that are not inlcuded in whitelisted hostnames', function() {
+  it('Should remove iframe src urls that are not included in whitelisted hostnames', function() {
     assert.equal(
       sanitizeHtml('<iframe src="https://www.embed.vevo.com/USUV71704255"></iframe>', {
         allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
@@ -682,7 +682,7 @@ describe('sanitizeHtml', function() {
       }), '<iframe src="https://www.vimeo.com/embed/c2IlcS7AHxM"></iframe>'
     );
   });
-  it('Should allow relative URLs for iframes', function() {
+  it('Should allow relative URLs for iframes by default', function() {
     assert.equal(
       sanitizeHtml('<iframe src="/foo"></iframe>', {
         allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
@@ -690,6 +690,43 @@ describe('sanitizeHtml', function() {
       }), '<iframe src="/foo"></iframe>'
     );
   });
+  it('Should allow relative URLs for iframes', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="/foo"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowIframeRelativeUrls: true,
+      }), '<iframe src="/foo"></iframe>'
+    );
+  });
+  it('Should remove relative URLs for iframes', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="/foo"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowIframeRelativeUrls: false,
+      }), '<iframe></iframe>'
+    );
+  });
+  it('Should remove relative URLs for iframes when whitelisted hostnames specified', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="/foo"></iframe><iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowedIframeHostnames: ['www.youtube.com']
+      }), '<iframe></iframe><iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>'
+    );
+  });
+  it('Should allow relative and whitelisted hostname URLs for iframes', function() {
+    assert.equal(
+      sanitizeHtml('<iframe src="/foo"></iframe><iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
+        allowedTags: ['p', 'iframe', 'a', 'img', 'i'],
+        allowedAttributes: {'iframe': ['src', 'href'], 'a': ['src', 'href'], 'img': ['src']},
+        allowIframeRelativeUrls: true,
+        allowedIframeHostnames: ['www.youtube.com']
+      }), '<iframe src="/foo"></iframe><iframe src="https://www.youtube.com/embed/c2IlcS7AHxM"></iframe>'
+    );
+  });
   it('Should allow protocol-relative URLs for the right domain for iframes', function() {
     assert.equal(
       sanitizeHtml('<iframe src="//www.youtube.com/embed/c2IlcS7AHxM"></iframe>', {
@@ -748,4 +785,38 @@ describe('sanitizeHtml', function() {
         allowedSchemes: sanitizeHtml.defaults.allowedSchemes.concat([ 'tel' ]),
       }), '<q cite=\"http://www.google.com\">HTTP</q><q cite=\"https://www.google.com\">HTTPS</q><q cite=\"mailto://www.google.com\">MAILTO</q><q cite=\"tel://www.google.com\">TEL</q><q cite=\"ftp://www.google.com\">FTP</q><q>DATA</q><q>LDAP</q><q>ACROBAT</q><q>VBSCRIPT</q><q>FILE</q><q>RLOGIN</q><q>WEBCAL</q><q>JAVASCRIPT</q><q>MMS</q>');
   });
+  it('Should encode &, <, > and where necessary, "', function() {
+    assert.equal(sanitizeHtml('"< & >" <span class="&#34;test&#34;">cool</span>', {
+      allowedTags: [ 'span' ],
+      allowedAttributes: {
+        span: [ 'class' ]
+      }
+    }), '"&lt; &amp; &gt;" <span class="&quot;test&quot;">cool</span>');
+  });
+  it('Should not pass through &0; unescaped if decodeEntities is true (the default)', function() {
+    assert.equal(sanitizeHtml('<img src="<0&0;0.2&" />', {allowedTags: ['img']}), '<img src="&lt;0&amp;0;0.2&amp;" />');
+  });
+  it('Should not double encode ampersands on HTML entities if decodeEntities is false (TODO more tests, this is too loose to rely upon)', function() {
+    var textIn = 'This &amp; & that &reg; &#x0000A; &#10; &plusmn; OK?';
+    var expectedResult = 'This &amp; &amp; that &reg; &#x0000A; &#10; &plusmn; OK?';
+    var sanitizeHtmlOptions = {
+      parser: {
+        decodeEntities: false
+      }
+    };
+    assert.equal(sanitizeHtml(textIn, sanitizeHtmlOptions), expectedResult);
+  });
+  // TODO: make this test and similar tests for entities that are not
+  // strictly valid pass, at which point decodeEntities: false is safe
+  // to use.
+  //
+  // it('Should not pass through &0; (a bogus entity) unescaped if decodeEntities is false', function() {
+  //   assert.equal(sanitizeHtml(
+  //     '<img src="<0&0;0.2&" />', {
+  //       allowedTags: ['img'],
+  //       parser: {
+  //         decodeEntities: false
+  //       }
+  //     }), '<img src="&lt;0&amp;0;0.2&amp;" />');
+  // });
 });