sanitize-html 1.23.0 → 1.27.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +16 -0
- package/README.md +52 -15
- package/dist/sanitize-html-es2015.js +2882 -3162
- package/dist/sanitize-html.js +802 -1475
- package/dist/sanitize-html.min.js +1 -1
- package/package.json +3 -6
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,21 @@
|
|
|
1
1
|
## Changelog
|
|
2
2
|
|
|
3
|
+
1.27.0:
|
|
4
|
+
- Adds the `allowedIframeDomains` option. This works similar to `allowedIframeHostnames`, where you would set it to an array of web domains. It would then permit any hostname on those domains to be used in iframe `src` attributes. Thanks to [Stanislav Kravchenko](https://github.com/StanisLove) for the contribution.
|
|
5
|
+
|
|
6
|
+
1.26.0:
|
|
7
|
+
- Adds the `option` element to the default `nonTextTagsArray` of tags with contents that aren't meant to be displayed visually as text. This can be overridden with the `nonTextTags` option.
|
|
8
|
+
|
|
9
|
+
1.25.0:
|
|
10
|
+
- Adds `enforceHtmlBoundary` option to process code bounded by the `html` tag, discarding any code outside of those tags.
|
|
11
|
+
- Migrates to the main lodash package from the per method packages since they are deprecated and cause code duplication. Thanks to [Merceyz](https://github.com/merceyz) for the contribution.
|
|
12
|
+
- Adds a warning when `style` and `script` tags are allowed, as they are inherently vulnerable to being used in XSS attacks. That warning can be disabled by including the option `allowVulnerableTags: true` so this choice is knowing and explicit.
|
|
13
|
+
|
|
14
|
+
1.24.0:
|
|
15
|
+
- Fixes a bug where self-closing tags resulted in deletion with `disallowedTagsMode: 'escape'` set. Thanks to [Thiago Negri](https://github.com/thiago-negri) for the contribution.
|
|
16
|
+
- Adds `abbr` to the default `allowedTags` for better accessibility support. Thanks to [Will Farrell](https://github.com/willfarrell) for the contribution.
|
|
17
|
+
- Adds a `mediaChildren` property to the `frame` object in custom filters. This allows you to check for links or other parent tags that contain self-contained media to prevent collapse, regardless of whether there is also text inside. Thanks to [axdg](https://github.com/axdg) for the initial implementation and [Marco Arduini](https://github.com/nerfologist) for a failing test contribution.
|
|
18
|
+
|
|
3
19
|
1.23.0:
|
|
4
20
|
- Adds eslint configuration and adds eslint to test script.
|
|
5
21
|
- Sets `sideEffects: false` on package.json to allow module bundlers like webpack tree-shake this module and all the dependencies from client build. Thanks to [Egor Voronov](https://github.com/egorvoronov) for the contribution.
|
package/README.md
CHANGED
|
@@ -10,7 +10,9 @@
|
|
|
10
10
|
|
|
11
11
|
`sanitize-html` allows you to specify the tags you want to permit, and the permitted attributes for each of those tags.
|
|
12
12
|
|
|
13
|
-
If a tag is not permitted, the contents of the tag are
|
|
13
|
+
If a tag is not permitted, the contents of the tag are not discarded. There are
|
|
14
|
+
some exceptions to this, discussed below in the "Discarding the entire contents
|
|
15
|
+
of a disallowed tag" section.
|
|
14
16
|
|
|
15
17
|
The syntax of poorly closed `p` and `img` elements is cleaned up.
|
|
16
18
|
|
|
@@ -107,7 +109,7 @@ If you do not specify `allowedTags` or `allowedAttributes` our default list is a
|
|
|
107
109
|
|
|
108
110
|
```js
|
|
109
111
|
allowedTags: [ 'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
|
|
110
|
-
'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
|
|
112
|
+
'nl', 'li', 'b', 'i', 'strong', 'em', 'strike', 'abbr', 'code', 'hr', 'br', 'div',
|
|
111
113
|
'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'iframe' ],
|
|
112
114
|
disallowedTagsMode: 'discard',
|
|
113
115
|
allowedAttributes: {
|
|
@@ -123,7 +125,8 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
|
|
|
123
125
|
allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
|
|
124
126
|
allowedSchemesByTag: {},
|
|
125
127
|
allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
|
|
126
|
-
allowProtocolRelative: true
|
|
128
|
+
allowProtocolRelative: true,
|
|
129
|
+
enforceHtmlBoundary: false
|
|
127
130
|
```
|
|
128
131
|
|
|
129
132
|
#### "What if I want to allow all tags or all attributes?"
|
|
@@ -187,6 +190,15 @@ allowedAttributes: {
|
|
|
187
190
|
'*': [ 'href', 'align', 'alt', 'center', 'bgcolor' ]
|
|
188
191
|
}
|
|
189
192
|
```
|
|
193
|
+
### Discarding text outside of ```<html></html>``` tags
|
|
194
|
+
|
|
195
|
+
Some text editing applications generate HTML to allow copying over to a web application. These can sometimes include undesireable control characters after terminating `html` tag. By default sanitize-html will not discard these characters, instead returning them in sanitized string. This behaviour can be modified using `enforceHtmlBoundary` option.
|
|
196
|
+
|
|
197
|
+
Setting this option to true will instruct sanitize-html to discard all characters outside of `html` tag boundaries -- before `<html>` and after `</html>` tags.
|
|
198
|
+
|
|
199
|
+
```javascript
|
|
200
|
+
enforceHtmlBoundary: true
|
|
201
|
+
```
|
|
190
202
|
|
|
191
203
|
### htmlparser2 Options
|
|
192
204
|
|
|
@@ -301,10 +313,11 @@ sanitizeHtml(
|
|
|
301
313
|
|
|
302
314
|
The `frame` object supplied to the callback provides the following attributes:
|
|
303
315
|
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
316
|
+
- `tag`: The tag name, i.e. `'img'`.
|
|
317
|
+
- `attribs`: The tag's attributes, i.e. `{ src: "/path/to/tux.png" }`.
|
|
318
|
+
- `text`: The text content of the tag.
|
|
319
|
+
- `mediaChildren`: Immediate child tags that are likely to represent self-contained media (e.g., `img`, `video`, `picture`, `iframe`). See the `mediaTags` variable in `src/index.js` for the full list.
|
|
320
|
+
- `tagPosition`: The index of the tag's position in the result string.
|
|
308
321
|
|
|
309
322
|
You can also process all text content with a provided filter function. Let's say we want an ellipsis instead of three dots.
|
|
310
323
|
|
|
@@ -331,14 +344,15 @@ Note that the text passed to the `textFilter` method is already escaped for safe
|
|
|
331
344
|
|
|
332
345
|
### Iframe Filters
|
|
333
346
|
|
|
334
|
-
If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function.
|
|
347
|
+
If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames and(or) array of domains that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function.
|
|
335
348
|
|
|
336
|
-
|
|
349
|
+
These arrays will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames or domains in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe.
|
|
337
350
|
|
|
338
351
|
Make sure to pass a valid hostname along with the domain you wish to allow, i.e.:
|
|
339
352
|
|
|
340
353
|
```javascript
|
|
341
|
-
allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
|
|
354
|
+
allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
|
|
355
|
+
allowedIframeDomains: ['zoom.us']
|
|
342
356
|
```
|
|
343
357
|
|
|
344
358
|
You may also specify whether or not to allow relative URLs as iframe sources.
|
|
@@ -347,7 +361,7 @@ You may also specify whether or not to allow relative URLs as iframe sources.
|
|
|
347
361
|
allowIframeRelativeUrls: true
|
|
348
362
|
```
|
|
349
363
|
|
|
350
|
-
Note that if unspecified, relative URLs will be allowed by default if no hostname filter is provided but removed by default if a hostname filter is provided.
|
|
364
|
+
Note that if unspecified, relative URLs will be allowed by default if no hostname or domain filter is provided but removed by default if a hostname or domain filter is provided.
|
|
351
365
|
|
|
352
366
|
**Remember that the `iframe` tag must be allowed as well as the `src` attribute.**
|
|
353
367
|
|
|
@@ -398,6 +412,24 @@ clean = sanitizeHtml('<p><iframe src="https://www.vimeo/video/12345"></iframe><p
|
|
|
398
412
|
|
|
399
413
|
will return an empty iframe tag.
|
|
400
414
|
|
|
415
|
+
If you want to allow any subdomain of any level you can provide the domain in `allowedIframeDomains`
|
|
416
|
+
|
|
417
|
+
```javascript
|
|
418
|
+
clean = sanitizeHtml('<p><iframe src="https://us02web.zoom.us/embed/12345"></iframe><p>', {
|
|
419
|
+
allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
|
|
420
|
+
allowedClasses: {
|
|
421
|
+
'p': [ 'fancy', 'simple' ],
|
|
422
|
+
},
|
|
423
|
+
allowedAttributes: {
|
|
424
|
+
'iframe': ['src']
|
|
425
|
+
},
|
|
426
|
+
allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
|
|
427
|
+
allowedIframeDomains: ['zoom.us']
|
|
428
|
+
});
|
|
429
|
+
```
|
|
430
|
+
|
|
431
|
+
will pass through as safe.
|
|
432
|
+
|
|
401
433
|
### Allowed CSS Classes
|
|
402
434
|
|
|
403
435
|
If you wish to allow specific CSS classes on a particular element, you can do so with the `allowedClasses` option. Any other CSS classes are discarded.
|
|
@@ -487,17 +519,22 @@ Normally, with a few exceptions, if a tag is not allowed, all of the text within
|
|
|
487
519
|
|
|
488
520
|
The exceptions are:
|
|
489
521
|
|
|
490
|
-
`style`, `script`, `textarea`
|
|
522
|
+
`style`, `script`, `textarea`, `option`
|
|
491
523
|
|
|
492
|
-
If you wish to
|
|
524
|
+
If you wish to replace this list, for instance to discard whatever is found
|
|
525
|
+
inside a `noscript` tag, use the `nonTextTags` option:
|
|
493
526
|
|
|
494
527
|
```javascript
|
|
495
|
-
nonTextTags: [ 'style', 'script', 'textarea', 'noscript' ]
|
|
528
|
+
nonTextTags: [ 'style', 'script', 'textarea', 'option', 'noscript' ]
|
|
496
529
|
```
|
|
497
530
|
|
|
498
531
|
Note that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.
|
|
499
532
|
|
|
500
|
-
The content still gets escaped properly, with the exception of the `script` and
|
|
533
|
+
The content still gets escaped properly, with the exception of the `script` and
|
|
534
|
+
`style` tags. *Allowing either `script` or `style` leaves you open to XSS
|
|
535
|
+
attacks. Don't do that* unless you have good reason to trust their origin.
|
|
536
|
+
sanitize-html will log a warning if these tags are allowed, which can be
|
|
537
|
+
disabled with the `allowVulnerableTags: true` option.
|
|
501
538
|
|
|
502
539
|
### Choose what to do with disallowed tags
|
|
503
540
|
|