sanitize-html 1.18.4 → 1.18.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +4 -0
  2. package/dist/index.js +2 -1
  3. package/dist/sanitize-html.js +6695 -6745
  4. package/dist/sanitize-html.min.js +12 -13
  5. package/package.json +1 -1
  6. package/src/index.js +4 -1
  7. package/test/test.js +13 -0
package/README.md CHANGED
@@ -480,6 +480,10 @@ The content still gets escaped properly, with the exception of the `script` and
480
480
 
481
481
  ## Changelog
482
482
 
483
+ 1.18.5:
484
+
485
+ * Stop double encoding ampersands on HTML entities. Thanks to Will Gibson.
486
+
483
487
  1.18.4:
484
488
 
485
489
  * Removed incorrect `browser` key, restoring frontend build. Thanks to Felix Becker.
package/dist/index.js CHANGED
@@ -451,7 +451,8 @@ function sanitizeHtml(html, options, _recursing) {
451
451
  if (typeof s !== 'string') {
452
452
  s = s + '';
453
453
  }
454
- return s.replace(/\&/g, '&amp;').replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
454
+ return s.replace(/&(?![a-zA-Z0-9#]{1,7};)/g, '&amp;') // Match ampersands not part of existing HTML entity
455
+ .replace(/</g, '&lt;').replace(/\>/g, '&gt;').replace(/\"/g, '&quot;');
455
456
  }
456
457
 
457
458
  function naughtyHref(name, href) {