sanitize-html 1.24.0 → 1.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/README.md +16 -2
- package/dist/sanitize-html-es2015.js +2656 -3029
- package/dist/sanitize-html.js +705 -1428
- package/dist/sanitize-html.min.js +1 -1
- package/package.json +4 -7
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,10 @@
|
|
|
1
1
|
## Changelog
|
|
2
2
|
|
|
3
|
+
1.25.0:
|
|
4
|
+
- Adds `enforceHtmlBoundary` option to process code bounded by the `html` tag, discarding any code outside of those tags.
|
|
5
|
+
- Migrates to the main lodash package from the per method packages since they are deprecated and cause code duplication. Thanks to [Merceyz](https://github.com/merceyz) for the contribution.
|
|
6
|
+
- Adds a warning when `style` and `script` tags are allowed, as they are inherently vulnerable to being used in XSS attacks. That warning can be disabled by including the option `allowVulnerableTags: true` so this choice is knowing and explicit.
|
|
7
|
+
|
|
3
8
|
1.24.0:
|
|
4
9
|
- Fixes a bug where self-closing tags resulted in deletion with `disallowedTagsMode: 'escape'` set. Thanks to [Thiago Negri](https://github.com/thiago-negri) for the contribution.
|
|
5
10
|
- Adds `abbr` to the default `allowedTags` for better accessibility support. Thanks to [Will Farrell](https://github.com/willfarrell) for the contribution.
|
package/README.md
CHANGED
|
@@ -123,7 +123,8 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
|
|
|
123
123
|
allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
|
|
124
124
|
allowedSchemesByTag: {},
|
|
125
125
|
allowedSchemesAppliedToAttributes: [ 'href', 'src', 'cite' ],
|
|
126
|
-
allowProtocolRelative: true
|
|
126
|
+
allowProtocolRelative: true,
|
|
127
|
+
enforceHtmlBoundary: false
|
|
127
128
|
```
|
|
128
129
|
|
|
129
130
|
#### "What if I want to allow all tags or all attributes?"
|
|
@@ -187,6 +188,15 @@ allowedAttributes: {
|
|
|
187
188
|
'*': [ 'href', 'align', 'alt', 'center', 'bgcolor' ]
|
|
188
189
|
}
|
|
189
190
|
```
|
|
191
|
+
### Discarding text outside of ```<html></html>``` tags
|
|
192
|
+
|
|
193
|
+
Some text editing applications generate HTML to allow copying over to a web application. These can sometimes include undesireable control characters after terminating `html` tag. By default sanitize-html will not discard these characters, instead returning them in sanitized string. This behaviour can be modified using `enforceHtmlBoundary` option.
|
|
194
|
+
|
|
195
|
+
Setting this option to true will instruct sanitize-html to discard all characters outside of `html` tag boundaries -- before `<html>` and after `</html>` tags.
|
|
196
|
+
|
|
197
|
+
```javascript
|
|
198
|
+
enforceHtmlBoundary: true
|
|
199
|
+
```
|
|
190
200
|
|
|
191
201
|
### htmlparser2 Options
|
|
192
202
|
|
|
@@ -498,7 +508,11 @@ nonTextTags: [ 'style', 'script', 'textarea', 'noscript' ]
|
|
|
498
508
|
|
|
499
509
|
Note that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.
|
|
500
510
|
|
|
501
|
-
The content still gets escaped properly, with the exception of the `script` and
|
|
511
|
+
The content still gets escaped properly, with the exception of the `script` and
|
|
512
|
+
`style` tags. *Allowing either `script` or `style` leaves you open to XSS
|
|
513
|
+
attacks. Don't do that* unless you have good reason to trust their origin.
|
|
514
|
+
sanitize-html will log a warning if these tags are allowed, which can be
|
|
515
|
+
disabled with the `allowVulnerableTags: true` option.
|
|
502
516
|
|
|
503
517
|
### Choose what to do with disallowed tags
|
|
504
518
|
|