sanitize-html 1.19.1 → 1.20.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## Changelog
 
+1.20.1: Fix failing tests, add CircleCI config
+
+1.20.0: reduced size of npm package via the `files` key; we only need to publish what's in `dist`. Thanks to Steven. There should be zero impact on behavior, minor version bump is precautionary.
+
+1.19.3: reverted to `postcss` due to a [reported issue with `css-tree` that might or might not have XSS implications](https://github.com/punkave/sanitize-html/issues/269).
+
+1.19.2:
+
+* Switched out the heavy `postcss` dependency for the lightweight `css-tree` module. No API changes. Thanks to Justin Braithwaite.
+* Various doc updates. Thanks to Pulkit Aggarwal and Cody Robertson.
+
 1.19.1:
 
 * `"` characters are now entity-escaped only when they appear in attribute values, reducing the verbosity of the resulting markup.
@@ -167,4 +178,3 @@ We're rocking our tests and have been working great in production for months, so
 0.1.1: discard the text of script tags.
 
 0.1.0: initial release.
-

package/README.md

@@ -1,6 +1,8 @@
 # sanitize-html
 
-<a href="http://apostrophenow.org/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
+[![CircleCI](https://circleci.com/gh/punkave/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/punkave/sanitize-html/tree/master)
+
+<a href="https://apostrophecms.org/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
 
 `sanitize-html` provides a simple HTML sanitizer with a clear API.
 
@@ -110,7 +112,8 @@ allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
 allowedAttributes: {
   a: [ 'href', 'name', 'target' ],
   // We don't currently allow img itself by default, but this
-  // would make sense if we did
+  // would make sense if we did. You could add srcset here,
+  // and if you do the URL is checked for safety
   img: [ 'src' ]
 },
 // Lots of these won't come up by default because we don't allow them
@@ -119,8 +122,7 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
 allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
 allowedSchemesByTag: {},
 allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
-allowProtocolRelative: true,
-allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+allowProtocolRelative: true
 ```
 
 #### "What if I want to allow all tags or all attributes?"
@@ -135,11 +137,11 @@ allowedAttributes: false
 
 #### "What if I don't want to allow *any* tags?"
 
-Also simple!  Set your `allowedTag` and `allowedAttributes` to empty arrays (`[]`).
+Also simple!  Set `allowedTags` to `[]` and `allowedAttributes` to `{}`.
 
 ```js
 allowedTags: [],
-allowedAttributes: []
+allowedAttributes: {}
 ```
 
 ### "What if I want to allow only specific values on some attributes?"

package/dist/index.js

@@ -547,9 +547,9 @@ function sanitizeHtml(html, options, _recursing) {
    */
   function stringifyStyleAttributes(filteredAST) {
     return filteredAST.nodes[0].nodes.reduce(function (extractedAttributes, attributeObject) {
-      extractedAttributes.push(attributeObject.prop + ':' + attributeObject.value + ';');
+      extractedAttributes.push(attributeObject.prop + ':' + attributeObject.value);
       return extractedAttributes;
-    }, []).join('');
+    }, []).join(';');
   }
 
   /**