sanitize-html 1.20.1 → 1.22.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## Changelog
 
+1.22.1: Increases the patch version of `lodash.mergewith` to enforce an audit fix.
+
+1.22.0: bumped `htmlparser2` dependency to the 4.x series. This fixes longstanding bugs and should cause no bc breaks for this module, since the only bc breaks upstream are in regard to features we don't expose in this module.
+
+1.21.1: fixed issue with bad `main` setting in package.json that broke 1.21.0.
+
+1.21.0: new `disallowedTagsMode` option can be set to `escape` to escape disallowed tags rather than discarding them. Any subtags are handled as usual. If you want to recursively escape them too, you can set `disallowedTagsMode` to `recursiveEscape`. Thanks to Yehonatan Zecharia for this contribution.
+
 1.20.1: Fix failing tests, add CircleCI config
 
 1.20.0: reduced size of npm package via the `files` key; we only need to publish what's in `dist`. Thanks to Steven. There should be zero impact on behavior, minor version bump is precautionary.
@@ -77,7 +85,7 @@ Please note that running `sanitize-html` in the browser is usually a security ho
 
 1.14.2: protocol-relative URL detection must spot URLs starting with `\\` rather than `//` due to ages-old tolerance features of web browsers, intended for sleepy Windows developers. Thanks to Martin Bajanik.
 
-1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.  
+1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.
 
 1.14.0: the new `allowProtocolRelative` option, which is set to `true` by default, allows you to decline to accept URLs that start with `//` and thus point to a different host using the current protocol. If you do **not** want to permit this, set this option to `false`. This is fully backwards compatible because the default behavior is to allow them. Thanks to Luke Bernard.
 

package/README.md

@@ -109,6 +109,7 @@ If you do not specify `allowedTags` or `allowedAttributes` our default list is a
 allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
   'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
   'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe' ],
+disallowedTagsMode: 'discard',
 allowedAttributes: {
   a: [ 'href', 'name', 'target' ],
   // We don't currently allow img itself by default, but this
@@ -144,6 +145,14 @@ allowedTags: [],
 allowedAttributes: {}
 ```
 
+### "What if I want disallowed tags to be escaped rather than discarded?"
+
+If you set `disallowedTagsMode` to `discard` (the default), disallowed tags are discarded. Any text content or subtags is still included, depending on whether the individual subtags are allowed.
+
+If you set `disallowedTagsMode` to `escape`, the disallowed tags are escaped rather than discarded. Any text or subtags is handled normally.
+
+If you set `disallowedTagsMode` to `recursiveEscape`, the disallowed tags are escaped rather than discarded, and the same treatment is applied to all subtags, whether otherwise allowed or not.
+
 ### "What if I want to allow only specific values on some attributes?"
 
 When configuring the attribute in `allowedAttributes` simply use an object with attribute `name` and an allowed `values` array. In the following example `sandbox="allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts"` would become `sandbox="allow-popups allow-scripts"`:
@@ -422,7 +431,7 @@ clean = sanitizeHtml(dirty, {
         allowedStyles: {
           '*': {
             // Match HEX and RGB
-            'color': [/^\#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/],
+            'color': [/^#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/],
             'text-align': [/^left$/, /^right$/, /^center$/],
             // Match any number with px, em, or %
             'font-size': [/^\d+(?:px|em|%)$/]
@@ -488,6 +497,18 @@ Note that if you use this option you are responsible for stating the entire list
 
 The content still gets escaped properly, with the exception of the `script` and `style` tags. *Allowing either `script` or `style` leaves you open to XSS attacks. Don't do that* unless you have good reason to trust their origin.
 
+### Choose what to do with disallowed tags
+
+Instead of discarding, or keeping text only, you may enable escaping of the entire content:
+
+```javascript
+disallowedTagsMode: 'escape'
+```
+
+This will transform `<disallowed>content</disallowed>` to `&lt;disallowed&gt;content&lt;/disallowed&gt;`
+
+Valid values are: `'discard'` (default), `'escape'` (escape the tag) and `'recursiveEscape'` (to escape the tag and all its content).
+
 ## About P'unk Avenue and Apostrophe
 
 `sanitize-html` was created at [P'unk Avenue](http://punkave.com) for use in ApostropheCMS, an open-source content management system built on node.js. If you like `sanitize-html` you should definitely [check out apostrophecms.org](http://apostrophecms.org).