sanitize-html 1.26.0 → 1.27.0

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 ## Changelog
 
+1.27.0:
+- Adds the `allowedIframeDomains` option. This works similar to `allowedIframeHostnames`, where you would set it to an array of web domains. It would then permit any hostname on those domains to be used in iframe `src` attributes. Thanks to [Stanislav Kravchenko](https://github.com/StanisLove) for the contribution.
+
 1.26.0:
 - Adds the `option` element to the default `nonTextTagsArray` of tags with contents that aren't meant to be displayed visually as text. This can be overridden with the `nonTextTags` option.
 

package/README.md

@@ -344,14 +344,15 @@ Note that the text passed to the `textFilter` method is already escaped for safe
 
 ### Iframe Filters
 
-If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function.
+If you would like to allow iframe tags but want to control the domains that are allowed through you can provide an array of hostnames and(or) array of domains that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the `sanitize-html` function.
 
-This array will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe.
+These arrays will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames or domains in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe.
 
 Make sure to pass a valid hostname along with the domain you wish to allow, i.e.:
 
 ```javascript
-  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
+  allowedIframeDomains: ['zoom.us']
 ```
 
 You may also specify whether or not to allow relative URLs as iframe sources.
@@ -360,7 +361,7 @@ You may also specify whether or not to allow relative URLs as iframe sources.
   allowIframeRelativeUrls: true
 ```
 
-Note that if unspecified, relative URLs will be allowed by default if no hostname filter is provided but removed by default if a hostname filter is provided.
+Note that if unspecified, relative URLs will be allowed by default if no hostname or domain filter is provided but removed by default if a hostname or domain filter is provided.
 
 **Remember that the `iframe` tag must be allowed as well as the `src` attribute.**
 
@@ -411,6 +412,24 @@ clean = sanitizeHtml('<p><iframe src="https://www.vimeo/video/12345"></iframe><p
 
 will return an empty iframe tag.
 
+If you want to allow any subdomain of any level you can provide the domain in `allowedIframeDomains`
+
+```javascript
+clean = sanitizeHtml('<p><iframe src="https://us02web.zoom.us/embed/12345"></iframe><p>', {
+  allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
+  allowedClasses: {
+    'p': [ 'fancy', 'simple' ],
+  },
+  allowedAttributes: {
+    'iframe': ['src']
+  },
+  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
+  allowedIframeDomains: ['zoom.us']
+});
+```
+
+will pass through as safe.
+
 ### Allowed CSS Classes
 
 If you wish to allow specific CSS classes on a particular element, you can do so with the `allowedClasses` option. Any other CSS classes are discarded.

package/dist/sanitize-html-es2015.js

@@ -20775,13 +20775,19 @@ function sanitizeHtml(html, options, _recursing) {
                 parsed = url.parse(value, false, true);
                 var isRelativeUrl = parsed && parsed.host === null && parsed.protocol === null;
                 if (isRelativeUrl) {
-                  // default value of allowIframeRelativeUrls is true unless allowIframeHostnames specified
+                  // default value of allowIframeRelativeUrls is true
+                  // unless allowedIframeHostnames or allowedIframeDomains specified
                   allowed = has(options, "allowIframeRelativeUrls")
-                    ? options.allowIframeRelativeUrls : !options.allowedIframeHostnames;
-                } else if (options.allowedIframeHostnames) {
-                  allowed = options.allowedIframeHostnames.find(function (hostname) {
+                    ? options.allowIframeRelativeUrls
+                    : (!options.allowedIframeHostnames && !options.allowedIframeDomains);
+                } else if (options.allowedIframeHostnames || options.allowedIframeDomains) {
+                  var allowedHostname = (options.allowedIframeHostnames || []).find(function (hostname) {
                     return hostname === parsed.hostname;
                   });
+                  var allowedDomain = (options.allowedIframeDomains || []).find(function(domain) {
+                    return parsed.hostname === domain || parsed.hostname.endsWith(`.${domain}`);
+                  });
+                  allowed = allowedHostname || allowedDomain;
                 }
               } catch (e) {
                 // Unparseable iframe src

package/dist/sanitize-html.js

@@ -4915,8 +4915,9 @@ var passedAllowedAttributesMapCheck=false;if(!allowedAttributesMap||has(allowedA
 var splitStrArray=value.split(' ');var _iterator11=_createForOfIteratorHelper(splitStrArray),_step2;try{for(_iterator11.s();!(_step2=_iterator11.n()).done;){var s=_step2.value;if(o.values.indexOf(s)!==-1){if(newValue===''){newValue=s;}else{newValue+=' '+s;}}}}catch(err){_iterator11.e(err);}finally{_iterator11.f();}}else if(o.values.indexOf(value)>=0){// verified an allowed value matches the entire attribute value
 newValue=value;}value=newValue;}}}catch(err){_iterator10.e(err);}finally{_iterator10.f();}}if(passedAllowedAttributesMapCheck){if(options.allowedSchemesAppliedToAttributes.indexOf(a)!==-1){if(naughtyHref(name,value)){delete frame.attribs[a];return;}}if(name==='iframe'&&a==='src'){var allowed=true;try{// naughtyHref is in charge of whether protocol relative URLs
 // are cool. We should just accept them
-parsed=url.parse(value,false,true);var isRelativeUrl=parsed&&parsed.host===null&&parsed.protocol===null;if(isRelativeUrl){// default value of allowIframeRelativeUrls is true unless allowIframeHostnames specified
-allowed=has(options,"allowIframeRelativeUrls")?options.allowIframeRelativeUrls:!options.allowedIframeHostnames;}else if(options.allowedIframeHostnames){allowed=options.allowedIframeHostnames.find(function(hostname){return hostname===parsed.hostname;});}}catch(e){// Unparseable iframe src
+parsed=url.parse(value,false,true);var isRelativeUrl=parsed&&parsed.host===null&&parsed.protocol===null;if(isRelativeUrl){// default value of allowIframeRelativeUrls is true
+// unless allowedIframeHostnames or allowedIframeDomains specified
+allowed=has(options,"allowIframeRelativeUrls")?options.allowIframeRelativeUrls:!options.allowedIframeHostnames&&!options.allowedIframeDomains;}else if(options.allowedIframeHostnames||options.allowedIframeDomains){var allowedHostname=(options.allowedIframeHostnames||[]).find(function(hostname){return hostname===parsed.hostname;});var allowedDomain=(options.allowedIframeDomains||[]).find(function(domain){return parsed.hostname===domain||parsed.hostname.endsWith(".".concat(domain));});allowed=allowedHostname||allowedDomain;}}catch(e){// Unparseable iframe src
 allowed=false;}if(!allowed){delete frame.attribs[a];return;}}if(a==='srcset'){try{parsed=srcset.parse(value);each(parsed,function(value){if(naughtyHref('srcset',value.url)){value.evil=true;}});parsed=filter(parsed,function(v){return!v.evil;});if(!parsed.length){delete frame.attribs[a];return;}else{value=srcset.stringify(filter(parsed,function(v){return!v.evil;}));frame.attribs[a]=value;}}catch(e){// Unparseable srcset
 delete frame.attribs[a];return;}}if(a==='class'){value=filterClasses(value,allowedClassesMap[name]);if(!value.length){delete frame.attribs[a];return;}}if(a==='style'){try{var abstractSyntaxTree=postcss.parse(name+" {"+value+"}");var filteredAST=filterCss(abstractSyntaxTree,options.allowedStyles);value=stringifyStyleAttributes(filteredAST);if(value.length===0){delete frame.attribs[a];return;}}catch(e){delete frame.attribs[a];return;}}result+=' '+a;if(value&&value.length){result+='="'+escapeHtml(value,true)+'"';}}else{delete frame.attribs[a];}});}if(options.selfClosing.indexOf(name)!==-1){result+=" />";}else{result+=">";if(frame.innerText&&!hasText&&!options.textFilter){result+=frame.innerText;}}if(skip){result=tempResult+escapeHtml(result);tempResult='';}},ontext:function ontext(text){if(skipText){return;}var lastFrame=stack[stack.length-1];var tag;if(lastFrame){tag=lastFrame.tag;// If inner text was set by transform function then let's use it
 text=lastFrame.innerText!==undefined?lastFrame.innerText:text;}if(options.disallowedTagsMode==='discard'&&(tag==='script'||tag==='style')){// htmlparser2 gives us these as-is. Escaping them ruins the content. Allowing