sanitize-html 1.22.0 → 1.25.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 ## Changelog
 
+1.25.0:
+- Adds `enforceHtmlBoundary` option to process code bounded by the `html` tag, discarding any code outside of those tags.
+- Migrates to the main lodash package from the per method packages since they are deprecated and cause code duplication. Thanks to [Merceyz](https://github.com/merceyz) for the contribution.
+- Adds a warning when `style` and `script` tags are allowed, as they are inherently vulnerable to being used in XSS attacks. That warning can be disabled by including the option `allowVulnerableTags: true` so this choice is knowing and explicit.
+
+1.24.0:
+- Fixes a bug where self-closing tags resulted in deletion with `disallowedTagsMode: 'escape'` set. Thanks to [Thiago Negri](https://github.com/thiago-negri) for the contribution.
+- Adds `abbr` to the default `allowedTags` for better accessibility support. Thanks to [Will Farrell](https://github.com/willfarrell) for the contribution.
+- Adds a `mediaChildren` property to the `frame` object in custom filters. This allows you to check for links or other parent tags that contain self-contained media to prevent collapse, regardless of whether there is also text inside. Thanks to [axdg](https://github.com/axdg) for the initial implementation and [Marco Arduini](https://github.com/nerfologist) for a failing test contribution.
+
+1.23.0:
+- Adds eslint configuration and adds eslint to test script.
+- Sets `sideEffects: false` on package.json to allow module bundlers like webpack tree-shake this module and all the dependencies from client build. Thanks to [Egor Voronov](https://github.com/egorvoronov) for the contribution.
+- Adds the `tagName` (HTML element name) as a second parameter passed to `textFilter`. Thanks to [Slava](https://github.com/slavaGanzin) for the contribution.
+
+1.22.1: Increases the patch version of `lodash.mergewith` to enforce an audit fix.
+
 1.22.0: bumped `htmlparser2` dependency to the 4.x series. This fixes longstanding bugs and should cause no bc breaks for this module, since the only bc breaks upstream are in regard to features we don't expose in this module.
 
 1.21.1: fixed issue with bad `main` setting in package.json that broke 1.21.0.
@@ -83,7 +100,7 @@ Please note that running `sanitize-html` in the browser is usually a security ho
 
 1.14.2: protocol-relative URL detection must spot URLs starting with `\\` rather than `//` due to ages-old tolerance features of web browsers, intended for sleepy Windows developers. Thanks to Martin Bajanik.
 
-1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.  
+1.14.1: documented `allowProtocolRelative` option. No code changes from 1.14.0, released a few moments ago.
 
 1.14.0: the new `allowProtocolRelative` option, which is set to `true` by default, allows you to decline to accept URLs that start with `//` and thus point to a different host using the current protocol. If you do **not** want to permit this, set this option to `false`. This is fully backwards compatible because the default behavior is to allow them. Thanks to Luke Bernard.
 

package/README.md

@@ -1,8 +1,8 @@
 # sanitize-html
 
-[![CircleCI](https://circleci.com/gh/punkave/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/punkave/sanitize-html/tree/master)
+[![CircleCI](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master)
 
-<a href="https://apostrophecms.org/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
+<a href="https://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
 
 `sanitize-html` provides a simple HTML sanitizer with a clear API.
 
@@ -107,7 +107,7 @@ If you do not specify `allowedTags` or `allowedAttributes` our default list is a
 
 ```js
 allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
-  'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
+  'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'abbr', 'code', 'hr', 'br', 'div',
   'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe' ],
 disallowedTagsMode: 'discard',
 allowedAttributes: {
@@ -123,7 +123,8 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
 allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
 allowedSchemesByTag: {},
 allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
-allowProtocolRelative: true
+allowProtocolRelative: true,
+enforceHtmlBoundary: false
 ```
 
 #### "What if I want to allow all tags or all attributes?"
@@ -187,6 +188,15 @@ allowedAttributes: {
   '*': [ 'href', 'align', 'alt', 'center', 'bgcolor' ]
 }
 ```
+### Discarding text outside of ```<html></html>``` tags
+
+Some text editing applications generate HTML to allow copying over to a web application. These can sometimes include undesireable control characters after terminating `html` tag. By default sanitize-html will not discard these characters, instead returning them in sanitized string. This behaviour can be modified using `enforceHtmlBoundary` option.
+
+Setting this option to true will instruct sanitize-html to discard all characters outside of `html` tag boundaries -- before `<html>` and after `</html>` tags.
+
+```javascript
+enforceHtmlBoundary: true
+```
 
 ### htmlparser2 Options
 
@@ -301,10 +311,11 @@ sanitizeHtml(
 
 The `frame` object supplied to the callback provides the following attributes:
 
- - `tag`: The tag name, i.e. `'img'`.
- - `attribs`: The tag's attributes, i.e. `{ src: "/path/to/tux.png" }`.
- - `text`: The text content of the tag.
- - `tagPosition`: The index of the tag's position in the result string.
+- `tag`: The tag name, i.e. `'img'`.
+- `attribs`: The tag's attributes, i.e. `{ src: "/path/to/tux.png" }`.
+- `text`: The text content of the tag.
+- `mediaChildren`: Immediate child tags that are likely to represent self-contained media (e.g., `img`, `video`, `picture`, `iframe`). See the `mediaTags` variable in `src/index.js` for the full list.
+- `tagPosition`: The index of the tag's position in the result string.
 
 You can also process all text content with a provided filter function. Let's say we want an ellipsis instead of three dots.
 
@@ -318,7 +329,9 @@ We can do that with the following filter:
 sanitizeHtml(
   '<p>some text...</p>',
   {
-    textFilter: function(text) {
+    textFilter: function(text, tagName) {
+      if (['a'].indexOf(tagName) > -1) return //Skip anchor tags
+
       return text.replace(/\.\.\./, '&hellip;');
     }
   }
@@ -495,7 +508,11 @@ nonTextTags: [ 'style', 'script', 'textarea', 'noscript' ]
 
 Note that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.
 
-The content still gets escaped properly, with the exception of the `script` and `style` tags. *Allowing either `script` or `style` leaves you open to XSS attacks. Don't do that* unless you have good reason to trust their origin.
+The content still gets escaped properly, with the exception of the `script` and
+`style` tags. *Allowing either `script` or `style` leaves you open to XSS
+attacks. Don't do that* unless you have good reason to trust their origin.
+sanitize-html will log a warning if these tags are allowed, which can be
+disabled with the `allowVulnerableTags: true` option.
 
 ### Choose what to do with disallowed tags
 
@@ -515,10 +532,10 @@ Valid values are: `'discard'` (default), `'escape'` (escape the tag) and `'recur
 
 ## Changelog
 
-[The changelog is now in a separate file for readability.](https://github.com/punkave/sanitize-html/blob/master/CHANGELOG.md)
+[The changelog is now in a separate file for readability.](https://github.com/apostrophecms/sanitize-html/blob/master/CHANGELOG.md)
 
 ## Support
 
-Feel free to open issues on [github](http://github.com/punkave/sanitize-html).
+Feel free to open issues on [github](http://github.com/apostrophecms/sanitize-html).
 
-<a href="http://punkave.com/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-builtby.png" /></a>
+<a href="http://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-builtby.png" /></a>