sanitize-html 1.22.1 → 1.23.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## Changelog
 
+1.23.0:
+- Adds eslint configuration and adds eslint to test script.
+- Sets `sideEffects: false` on package.json to allow module bundlers like webpack tree-shake this module and all the dependencies from client build. Thanks to [Egor Voronov](https://github.com/egorvoronov) for the contribution.
+- Adds the `tagName` (HTML element name) as a second parameter passed to `textFilter`. Thanks to [Slava](https://github.com/slavaGanzin) for the contribution.
+
 1.22.1: Increases the patch version of `lodash.mergewith` to enforce an audit fix.
 
 1.22.0: bumped `htmlparser2` dependency to the 4.x series. This fixes longstanding bugs and should cause no bc breaks for this module, since the only bc breaks upstream are in regard to features we don't expose in this module.

package/README.md

@@ -1,8 +1,8 @@
 # sanitize-html
 
-[![CircleCI](https://circleci.com/gh/punkave/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/punkave/sanitize-html/tree/master)
+[![CircleCI](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master)
 
-<a href="https://apostrophecms.org/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
+<a href="https://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
 
 `sanitize-html` provides a simple HTML sanitizer with a clear API.
 
@@ -318,7 +318,9 @@ We can do that with the following filter:
 sanitizeHtml(
   '<p>some text...</p>',
   {
-    textFilter: function(text) {
+    textFilter: function(text, tagName) {
+      if (['a'].indexOf(tagName) > -1) return //Skip anchor tags
+
       return text.replace(/\.\.\./, '&hellip;');
     }
   }
@@ -515,10 +517,10 @@ Valid values are: `'discard'` (default), `'escape'` (escape the tag) and `'recur
 
 ## Changelog
 
-[The changelog is now in a separate file for readability.](https://github.com/punkave/sanitize-html/blob/master/CHANGELOG.md)
+[The changelog is now in a separate file for readability.](https://github.com/apostrophecms/sanitize-html/blob/master/CHANGELOG.md)
 
 ## Support
 
-Feel free to open issues on [github](http://github.com/punkave/sanitize-html).
+Feel free to open issues on [github](http://github.com/apostrophecms/sanitize-html).
 
-<a href="http://punkave.com/"><img src="https://raw.github.com/punkave/sanitize-html/master/logos/logo-box-builtby.png" /></a>
+<a href="http://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-builtby.png" /></a>

package/dist/sanitize-html-es2015.js

@@ -20807,6 +20807,7 @@ function extend() {
 }
 
 },{}],83:[function(require,module,exports){
+/* eslint-disable no-useless-escape */
 var htmlparser = require('htmlparser2');
 var extend = require('xtend');
 var quoteRegexp = require('lodash.escaperegexp');
@@ -20819,9 +20820,11 @@ var postcss = require('postcss');
 var url = require('url');
 
 function each(obj, cb) {
-  if (obj) Object.keys(obj).forEach(function (key) {
-    cb(obj[key], key);
-  });
+  if (obj) {
+    Object.keys(obj).forEach(function (key) {
+      cb(obj[key], key);
+    });
+  }
 }
 
 // Avoid false positives with .__proto__, .hasOwnProperty, etc.
@@ -20841,7 +20844,7 @@ function filter(a, cb) {
 }
 
 function isEmptyObject(obj) {
-  for(var key in obj) {
+  for (var key in obj) {
     if (has(obj, key)) {
       return false;
     }
@@ -20882,8 +20885,8 @@ function sanitizeHtml(html, options, _recursing) {
 
     this.updateParentNodeText = function() {
       if (stack.length) {
-          var parentFrame = stack[stack.length - 1];
-          parentFrame.text += that.text;
+        var parentFrame = stack[stack.length - 1];
+        parentFrame.text += that.text;
       }
     };
   }
@@ -20907,14 +20910,14 @@ function sanitizeHtml(html, options, _recursing) {
   var nonTextTagsArray = options.nonTextTags || [ 'script', 'style', 'textarea' ];
   var allowedAttributesMap;
   var allowedAttributesGlobMap;
-  if(options.allowedAttributes) {
+  if (options.allowedAttributes) {
     allowedAttributesMap = {};
     allowedAttributesGlobMap = {};
     each(options.allowedAttributes, function(attributes, tag) {
       allowedAttributesMap[tag] = [];
       var globRegex = [];
       attributes.forEach(function(obj) {
-        if(isString(obj) && obj.indexOf('*') >= 0) {
+        if (isString(obj) && obj.indexOf('*') >= 0) {
           globRegex.push(quoteRegexp(obj).replace(/\\\*/g, '.*'));
         } else {
           allowedAttributesMap[tag].push(obj);
@@ -20926,14 +20929,14 @@ function sanitizeHtml(html, options, _recursing) {
   var allowedClassesMap = {};
   each(options.allowedClasses, function(classes, tag) {
     // Implicitly allows the class attribute
-    if(allowedAttributesMap) {
+    if (allowedAttributesMap) {
       if (!has(allowedAttributesMap, tag)) {
         allowedAttributesMap[tag] = [];
       }
       allowedAttributesMap[tag].push('class');
     }
 
-    allowedClassesMap[tag] = classes
+    allowedClassesMap[tag] = classes;
   });
 
   var transformTagsMap = {};
@@ -20969,7 +20972,7 @@ function sanitizeHtml(html, options, _recursing) {
       stack.push(frame);
 
       var skip = false;
-      var hasText = frame.text ? true : false;
+      var hasText = !!frame.text;
       var transformedTag;
       if (has(transformTagsMap, name)) {
         transformedTag = transformTagsMap[name](name, attribs);
@@ -21029,11 +21032,11 @@ function sanitizeHtml(html, options, _recursing) {
           // as necessary if there are specific values defined.
           var passedAllowedAttributesMapCheck = false;
           if (!allowedAttributesMap ||
-            (has(allowedAttributesMap, name) && allowedAttributesMap[name].indexOf(a) !== -1 ) ||
-            (allowedAttributesMap['*'] && allowedAttributesMap['*'].indexOf(a) !== -1 ) ||
+            (has(allowedAttributesMap, name) && allowedAttributesMap[name].indexOf(a) !== -1) ||
+            (allowedAttributesMap['*'] && allowedAttributesMap['*'].indexOf(a) !== -1) ||
             (has(allowedAttributesGlobMap, name) && allowedAttributesGlobMap[name].test(a)) ||
             (allowedAttributesGlobMap['*'] && allowedAttributesGlobMap['*'].test(a))) {
-              passedAllowedAttributesMapCheck = true;
+            passedAllowedAttributesMapCheck = true;
           } else if (allowedAttributesMap && allowedAttributesMap[name]) {
             for (const o of allowedAttributesMap[name]) {
               if (isPlainObject(o) && o.name && (o.name === a)) {
@@ -21075,8 +21078,8 @@ function sanitizeHtml(html, options, _recursing) {
                 var isRelativeUrl = parsed && parsed.host === null && parsed.protocol === null;
                 if (isRelativeUrl) {
                   // default value of allowIframeRelativeUrls is true unless allowIframeHostnames specified
-                  allowed = has(options, "allowIframeRelativeUrls") ?
-                    options.allowIframeRelativeUrls : !options.allowedIframeHostnames;
+                  allowed = has(options, "allowIframeRelativeUrls")
+                    ? options.allowIframeRelativeUrls : !options.allowedIframeHostnames;
                 } else if (options.allowedIframeHostnames) {
                   allowed = options.allowedIframeHostnames.find(function (hostname) {
                     return hostname === parsed.hostname;
@@ -21131,7 +21134,7 @@ function sanitizeHtml(html, options, _recursing) {
 
                 value = stringifyStyleAttributes(filteredAST);
 
-                if(value.length === 0) {
+                if (value.length === 0) {
                   delete frame.attribs[a];
                   return;
                 }
@@ -21166,7 +21169,7 @@ function sanitizeHtml(html, options, _recursing) {
       if (skipText) {
         return;
       }
-      var lastFrame = stack[stack.length-1];
+      var lastFrame = stack[stack.length - 1];
       var tag;
 
       if (lastFrame) {
@@ -21184,14 +21187,14 @@ function sanitizeHtml(html, options, _recursing) {
       } else {
         var escaped = escapeHtml(text, false);
         if (options.textFilter) {
-          result += options.textFilter(escaped);
+          result += options.textFilter(escaped, tag);
         } else {
           result += escaped;
         }
       }
       if (stack.length) {
-           var frame = stack[stack.length - 1];
-           frame.text += text;
+        var frame = stack[stack.length - 1];
+        frame.text += text;
       }
     },
     onclosetag: function(name) {
@@ -21229,15 +21232,15 @@ function sanitizeHtml(html, options, _recursing) {
       }
 
       if (options.exclusiveFilter && options.exclusiveFilter(frame)) {
-         result = result.substr(0, frame.tagPosition);
-         return;
+        result = result.substr(0, frame.tagPosition);
+        return;
       }
 
       frame.updateParentNodeText();
 
       if (options.selfClosing.indexOf(name) !== -1) {
-         // Already output />
-         return;
+        // Already output />
+        return;
       }
 
       result += "</" + name + ">";
@@ -21253,7 +21256,7 @@ function sanitizeHtml(html, options, _recursing) {
   return result;
 
   function escapeHtml(s, quote) {
-    if (typeof(s) !== 'string') {
+    if (typeof (s) !== 'string') {
       s = s + '';
     }
     if (options.parser.decodeEntities) {
@@ -21280,6 +21283,7 @@ function sanitizeHtml(html, options, _recursing) {
     // Browsers ignore character codes of 32 (space) and below in a surprising
     // number of situations. Start reading here:
     // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_tab
+    // eslint-disable-next-line no-control-regex
     href = href.replace(/[\x00-\x20]+/g, '');
     // Clobber any comments in URLs, which the browser might
     // interpret inside an XML data island, allowing

package/dist/sanitize-html.js

@@ -5557,7 +5557,7 @@ if(psychotic){result.hostname=result.host=isAbsolute?'':srcPath.length?srcPath.s
 //this especially happens in cases like
 //url.resolveObject('mailto:local1@domain1', 'local2@domain2')
 var authInHost=result.host&&result.host.indexOf('@')>0?result.host.split('@'):false;if(authInHost){result.auth=authInHost.shift();result.host=result.hostname=authInHost.shift();}}mustEndAbs=mustEndAbs||result.host&&srcPath.length;if(mustEndAbs&&!isAbsolute){srcPath.unshift('');}if(!srcPath.length){result.pathname=null;result.path=null;}else{result.pathname=srcPath.join('/');}//to support request.http
-if(!util.isNull(result.pathname)||!util.isNull(result.search)){result.path=(result.pathname?result.pathname:'')+(result.search?result.search:'');}result.auth=relative.auth||result.auth;result.slashes=result.slashes||relative.slashes;result.href=result.format();return result;};Url.prototype.parseHost=function(){var host=this.host;var port=portPattern.exec(host);if(port){port=port[0];if(port!==':'){this.port=port.substr(1);}host=host.substr(0,host.length-port.length);}if(host)this.hostname=host;};},{"./util":81,"punycode":64,"querystring":67}],81:[function(require,module,exports){'use strict';module.exports={isString:function isString(arg){return typeof arg==='string';},isObject:function isObject(arg){return _typeof(arg)==='object'&&arg!==null;},isNull:function isNull(arg){return arg===null;},isNullOrUndefined:function isNullOrUndefined(arg){return arg==null;}};},{}],82:[function(require,module,exports){module.exports=extend;var hasOwnProperty=Object.prototype.hasOwnProperty;function extend(){var target={};for(var i=0;i<arguments.length;i++){var source=arguments[i];for(var key in source){if(hasOwnProperty.call(source,key)){target[key]=source[key];}}}return target;}},{}],83:[function(require,module,exports){var htmlparser=require('htmlparser2');var extend=require('xtend');var quoteRegexp=require('lodash.escaperegexp');var cloneDeep=require('lodash.clonedeep');var mergeWith=require('lodash.mergewith');var isString=require('lodash.isstring');var isPlainObject=require('lodash.isplainobject');var srcset=require('srcset');var postcss=require('postcss');var url=require('url');function each(obj,cb){if(obj)Object.keys(obj).forEach(function(key){cb(obj[key],key);});}// Avoid false positives with .__proto__, .hasOwnProperty, etc.
+if(!util.isNull(result.pathname)||!util.isNull(result.search)){result.path=(result.pathname?result.pathname:'')+(result.search?result.search:'');}result.auth=relative.auth||result.auth;result.slashes=result.slashes||relative.slashes;result.href=result.format();return result;};Url.prototype.parseHost=function(){var host=this.host;var port=portPattern.exec(host);if(port){port=port[0];if(port!==':'){this.port=port.substr(1);}host=host.substr(0,host.length-port.length);}if(host)this.hostname=host;};},{"./util":81,"punycode":64,"querystring":67}],81:[function(require,module,exports){'use strict';module.exports={isString:function isString(arg){return typeof arg==='string';},isObject:function isObject(arg){return _typeof(arg)==='object'&&arg!==null;},isNull:function isNull(arg){return arg===null;},isNullOrUndefined:function isNullOrUndefined(arg){return arg==null;}};},{}],82:[function(require,module,exports){module.exports=extend;var hasOwnProperty=Object.prototype.hasOwnProperty;function extend(){var target={};for(var i=0;i<arguments.length;i++){var source=arguments[i];for(var key in source){if(hasOwnProperty.call(source,key)){target[key]=source[key];}}}return target;}},{}],83:[function(require,module,exports){/* eslint-disable no-useless-escape */var htmlparser=require('htmlparser2');var extend=require('xtend');var quoteRegexp=require('lodash.escaperegexp');var cloneDeep=require('lodash.clonedeep');var mergeWith=require('lodash.mergewith');var isString=require('lodash.isstring');var isPlainObject=require('lodash.isplainobject');var srcset=require('srcset');var postcss=require('postcss');var url=require('url');function each(obj,cb){if(obj){Object.keys(obj).forEach(function(key){cb(obj[key],key);});}}// Avoid false positives with .__proto__, .hasOwnProperty, etc.
 function has(obj,key){return{}.hasOwnProperty.call(obj,key);}// Returns those elements of `a` for which `cb(a)` returns truthy
 function filter(a,cb){var n=[];each(a,function(v){if(cb(v)){n.push(v);}});return n;}function isEmptyObject(obj){for(var key in obj){if(has(obj,key)){return false;}}return true;}module.exports=sanitizeHtml;// A valid attribute name.
 // We use a tolerant definition based on the set of strings defined by
@@ -5580,7 +5580,7 @@ this.updateParentNodeText=function(){if(stack.length){var parentFrame=stack[stac
 // If we are not allowing these tags, we should drop their content too.
 // For other tags you would drop the tag but keep its content.
 var nonTextTagsArray=options.nonTextTags||['script','style','textarea'];var allowedAttributesMap;var allowedAttributesGlobMap;if(options.allowedAttributes){allowedAttributesMap={};allowedAttributesGlobMap={};each(options.allowedAttributes,function(attributes,tag){allowedAttributesMap[tag]=[];var globRegex=[];attributes.forEach(function(obj){if(isString(obj)&&obj.indexOf('*')>=0){globRegex.push(quoteRegexp(obj).replace(/\\\*/g,'.*'));}else{allowedAttributesMap[tag].push(obj);}});allowedAttributesGlobMap[tag]=new RegExp('^('+globRegex.join('|')+')$');});}var allowedClassesMap={};each(options.allowedClasses,function(classes,tag){// Implicitly allows the class attribute
-if(allowedAttributesMap){if(!has(allowedAttributesMap,tag)){allowedAttributesMap[tag]=[];}allowedAttributesMap[tag].push('class');}allowedClassesMap[tag]=classes;});var transformTagsMap={};var transformTagsAll;each(options.transformTags,function(transform,tag){var transFun;if(typeof transform==='function'){transFun=transform;}else if(typeof transform==="string"){transFun=sanitizeHtml.simpleTransform(transform);}if(tag==='*'){transformTagsAll=transFun;}else{transformTagsMap[tag]=transFun;}});var depth=0;var stack=[];var skipMap={};var transformMap={};var skipText=false;var skipTextDepth=0;var parser=new htmlparser.Parser({onopentag:function onopentag(name,attribs){if(skipText){skipTextDepth++;return;}var frame=new Frame(name,attribs);stack.push(frame);var skip=false;var hasText=frame.text?true:false;var transformedTag;if(has(transformTagsMap,name)){transformedTag=transformTagsMap[name](name,attribs);frame.attribs=attribs=transformedTag.attribs;if(transformedTag.text!==undefined){frame.innerText=transformedTag.text;}if(name!==transformedTag.tagName){frame.name=name=transformedTag.tagName;transformMap[depth]=transformedTag.tagName;}}if(transformTagsAll){transformedTag=transformTagsAll(name,attribs);frame.attribs=attribs=transformedTag.attribs;if(name!==transformedTag.tagName){frame.name=name=transformedTag.tagName;transformMap[depth]=transformedTag.tagName;}}if(options.allowedTags&&options.allowedTags.indexOf(name)===-1||options.disallowedTagsMode==='recursiveEscape'&&!isEmptyObject(skipMap)){skip=true;skipMap[depth]=true;if(options.disallowedTagsMode==='discard'){if(nonTextTagsArray.indexOf(name)!==-1){skipText=true;skipTextDepth=1;}}skipMap[depth]=true;}depth++;if(skip){if(options.disallowedTagsMode==='discard'){// We want the contents but not this tag
+if(allowedAttributesMap){if(!has(allowedAttributesMap,tag)){allowedAttributesMap[tag]=[];}allowedAttributesMap[tag].push('class');}allowedClassesMap[tag]=classes;});var transformTagsMap={};var transformTagsAll;each(options.transformTags,function(transform,tag){var transFun;if(typeof transform==='function'){transFun=transform;}else if(typeof transform==="string"){transFun=sanitizeHtml.simpleTransform(transform);}if(tag==='*'){transformTagsAll=transFun;}else{transformTagsMap[tag]=transFun;}});var depth=0;var stack=[];var skipMap={};var transformMap={};var skipText=false;var skipTextDepth=0;var parser=new htmlparser.Parser({onopentag:function onopentag(name,attribs){if(skipText){skipTextDepth++;return;}var frame=new Frame(name,attribs);stack.push(frame);var skip=false;var hasText=!!frame.text;var transformedTag;if(has(transformTagsMap,name)){transformedTag=transformTagsMap[name](name,attribs);frame.attribs=attribs=transformedTag.attribs;if(transformedTag.text!==undefined){frame.innerText=transformedTag.text;}if(name!==transformedTag.tagName){frame.name=name=transformedTag.tagName;transformMap[depth]=transformedTag.tagName;}}if(transformTagsAll){transformedTag=transformTagsAll(name,attribs);frame.attribs=attribs=transformedTag.attribs;if(name!==transformedTag.tagName){frame.name=name=transformedTag.tagName;transformMap[depth]=transformedTag.tagName;}}if(options.allowedTags&&options.allowedTags.indexOf(name)===-1||options.disallowedTagsMode==='recursiveEscape'&&!isEmptyObject(skipMap)){skip=true;skipMap[depth]=true;if(options.disallowedTagsMode==='discard'){if(nonTextTagsArray.indexOf(name)!==-1){skipText=true;skipTextDepth=1;}}skipMap[depth]=true;}depth++;if(skip){if(options.disallowedTagsMode==='discard'){// We want the contents but not this tag
 return;}tempResult=result;result='';}result+='<'+name;if(!allowedAttributesMap||has(allowedAttributesMap,name)||allowedAttributesMap['*']){each(attribs,function(value,a){if(!VALID_HTML_ATTRIBUTE_NAME.test(a)){// This prevents part of an attribute name in the output from being
 // interpreted as the end of an attribute, or end of a tag.
 delete frame.attribs[a];return;}var parsed;// check allowedAttributesMap for the element and attribute and modify the value
@@ -5597,7 +5597,7 @@ text=lastFrame.innerText!==undefined?lastFrame.innerText:text;}if(options.disall
 // script tags is, by definition, game over for XSS protection, so if that's
 // your concern, don't allow them. The same is essentially true for style tags
 // which have their own collection of XSS vectors.
-result+=text;}else{var escaped=escapeHtml(text,false);if(options.textFilter){result+=options.textFilter(escaped);}else{result+=escaped;}}if(stack.length){var frame=stack[stack.length-1];frame.text+=text;}},onclosetag:function onclosetag(name){if(skipText){skipTextDepth--;if(!skipTextDepth){skipText=false;}else{return;}}var frame=stack.pop();if(!frame){// Do not crash on bad markup
+result+=text;}else{var escaped=escapeHtml(text,false);if(options.textFilter){result+=options.textFilter(escaped,tag);}else{result+=escaped;}}if(stack.length){var frame=stack[stack.length-1];frame.text+=text;}},onclosetag:function onclosetag(name){if(skipText){skipTextDepth--;if(!skipTextDepth){skipText=false;}else{return;}}var frame=stack.pop();if(!frame){// Do not crash on bad markup
 return;}skipText=false;depth--;var skip=skipMap[depth];if(skip){delete skipMap[depth];if(options.disallowedTagsMode==='discard'){frame.updateParentNodeText();return;}tempResult=result;result='';}if(transformMap[depth]){name=transformMap[depth];delete transformMap[depth];}if(options.exclusiveFilter&&options.exclusiveFilter(frame)){result=result.substr(0,frame.tagPosition);return;}frame.updateParentNodeText();if(options.selfClosing.indexOf(name)!==-1){// Already output />
 return;}result+="</"+name+">";if(skip){result=tempResult+escapeHtml(result);tempResult='';}}},options.parser);parser.write(html);parser.end();return result;function escapeHtml(s,quote){if(typeof s!=='string'){s=s+'';}if(options.parser.decodeEntities){s=s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/\>/g,'&gt;');if(quote){s=s.replace(/\"/g,'&quot;');}}// TODO: this is inadequate because it will pass `&0;`. This approach
 // will not work, each & must be considered with regard to whether it
@@ -5608,6 +5608,7 @@ s=s.replace(/&(?![a-zA-Z0-9#]{1,20};)/g,'&amp;')// Match ampersands not part of
 .replace(/</g,'&lt;').replace(/\>/g,'&gt;');if(quote){s=s.replace(/\"/g,'&quot;');}return s;}function naughtyHref(name,href){// Browsers ignore character codes of 32 (space) and below in a surprising
 // number of situations. Start reading here:
 // https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Embedded_tab
+// eslint-disable-next-line no-control-regex
 href=href.replace(/[\x00-\x20]+/g,'');// Clobber any comments in URLs, which the browser might
 // interpret inside an XML data island, allowing
 // a javascript: URL to be snuck through