sanitize-html 1.27.1 → 1.27.5

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 ## Changelog
 
+1.27.5 (2020-09-23):
+- Updates README to include ES modules syntax.
+
+1.27.4 (2020-08-26):
+- Fixes an IE11 regression from using `Array.prototype.includes`, replacing it with `Array.prototype.indexOf`.
+
+1.27.3 (2020-08-12):
+- Fixes a bug when using `transformTags` with out `textFilter`. Thanks to [Andrzej Porebski](https://github.com/andpor) for the help with a failing test.
+
+1.27.2 (2020-07-29):
+- Fixes CHANGELOG links. Thanks to [Alex Mayer](https://github.com/amayer5125) for the contribution.
+- Replaces `srcset` with `parse-srcset`. Thanks to [Massimiliano Mirra](https://github.com/bard) for the contribution.
+
 1.27.1 (2020-07-15):
 - Removes the unused chalk dependency.
 - Adds configuration for a Github stale bot.
@@ -88,9 +101,7 @@ There is currently a commented-out test which verifies one example of the proble
 1.18.0:
 
 * The new `allowedSchemesAppliedToAttributes` option. This determines which attributes are validated as URLs, replacing the old hardcoded list of `src` and `href` only. The default list now includes `cite`. Thanks to ml-dublin for this contribution.
-
 * It is now easy to configure a specific list of allowed values for an attribute. When configuring `allowedAttributes`, rather than listing an attribute name, simply list an object with an attribute `name` property and an allowed `values` array property. You can also add `multiple: true` to allow multiple space-separated allowed values in the attribute, otherwise the attribute must match one and only one of the allowed values. Thanks again to ml-dublin for this contribution.
-
 * Fixed a bug in the npm test procedure.
 
 1.17.0: the new `allowedIframeHostnames` option. If present, this must be an array, and only iframe `src` URLs hostnames (complete hostnames; domain name matches are not enough) that appear on this list are allowed. You must also configure `hostname` as an allowed attribute for `iframe`. Thanks to Ryan Verys for this contribution.

package/README.md

@@ -1,8 +1,8 @@
 # sanitize-html
 
-[![CircleCI](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master.svg?style=svg)](https://circleci.com/gh/apostrophecms/sanitize-html/tree/master)
+[![CircleCI](https://circleci.com/gh/apostrophecms/sanitize-html/tree/main.svg?style=svg)](https://circleci.com/gh/apostrophecms/sanitize-html/tree/main)
 
-<a href="https://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-madefor.png" align="right" /></a>
+<a href="https://apostrophecms.com/"><img src="https://raw.githubusercontent.com/apostrophecms/sanitize-html/main/logos/logo-box-madefor.png" align="right" /></a>
 
 `sanitize-html` provides a simple HTML sanitizer with a clear API.
 
@@ -71,13 +71,21 @@ Install module from console:
 npm install sanitize-html
 ```
 
-Use it in your node app:
+Import the module:
 
-```js
-var sanitizeHtml = require('sanitize-html');
+```bash
+// In ESM
+import sanitizeHtml from 'sanitize-html';
+
+// Or in CJS
+const sanitizeHtml = require('sanitize-html');
+```
 
-var dirty = 'some really tacky HTML';
-var clean = sanitizeHtml(dirty);
+Use it in your JavaScript app:
+
+```js
+const dirty = 'some really tacky HTML';
+const clean = sanitizeHtml(dirty);
 ```
 
 That will allow our default list of allowed tags and attributes through. It's a nice set, but probably not quite what you want. So:
@@ -161,14 +169,15 @@ If you set `disallowedTagsMode` to `recursiveEscape`, the disallowed tags are es
 When configuring the attribute in `allowedAttributes` simply use an object with attribute `name` and an allowed `values` array. In the following example `sandbox="allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts"` would become `sandbox="allow-popups allow-scripts"`:
 
 ```js
-        allowedAttributes: {
-          iframe: [
-            {
-              name: 'sandbox',
-              multiple: true,
-              values: ['allow-popups', 'allow-same-origin', 'allow-scripts']
-            }
-          ]
+allowedAttributes: {
+  iframe: [
+    {
+      name: 'sandbox',
+      multiple: true,
+      values: ['allow-popups', 'allow-same-origin', 'allow-scripts']
+    }
+  ]
+}
 ```
 
 With `multiple: true`, several allowed values may appear in the same attribute, separated by spaces. Otherwise the attribute must exactly match one and only one of the allowed values.
@@ -177,7 +186,7 @@ With `multiple: true`, several allowed values may appear in the same attribute,
 
 You can use the `*` wildcard to allow all attributes with a certain prefix:
 
-```javascript
+```js
 allowedAttributes: {
   a: [ 'href', 'data-*' ]
 }
@@ -185,7 +194,7 @@ allowedAttributes: {
 
 Also you can use the `*` as name for a tag, to allow listed attributes to be valid for any tag:
 
-```javascript
+```js
 allowedAttributes: {
   '*': [ 'href', 'align', 'alt', 'center', 'bgcolor' ]
 }
@@ -196,7 +205,7 @@ Some text editing applications generate HTML to allow copying over to a web appl
 
 Setting this option to true will instruct sanitize-html to discard all characters outside of `html` tag boundaries -- before `<html>` and after `</html>` tags.
 
-```javascript
+```js
 enforceHtmlBoundary: true
 ```
 
@@ -204,7 +213,7 @@ enforceHtmlBoundary: true
 
 `santizeHtml` is built on `htmlparser2`. By default the only option passed down is `decodeEntities: true` You can set the options to pass by using the parser option.
 
-```javascript
+```js
 clean = sanitizeHtml(dirty, {
   allowedTags: ['a'],
   parser: {
@@ -234,14 +243,14 @@ The most advanced usage:
 clean = sanitizeHtml(dirty, {
   transformTags: {
     'ol': function(tagName, attribs) {
-        // My own custom magic goes here
-
-        return {
-            tagName: 'ul',
-            attribs: {
-                class: 'foo'
-            }
-        };
+      // My own custom magic goes here
+
+      return {
+        tagName: 'ul',
+        attribs: {
+          class: 'foo'
+        }
+      };
     }
   }
 });
@@ -273,10 +282,10 @@ You can also add or modify the text contents of a tag:
 clean = sanitizeHtml(dirty, {
   transformTags: {
     'a': function(tagName, attribs) {
-        return {
-            tagName: 'a',
-            text: 'Some text'
-        };
+      return {
+        tagName: 'a',
+        text: 'Some text'
+      };
     }
   }
 });
@@ -300,12 +309,12 @@ You can provide a filter function to remove unwanted tags. Let's suppose we need
 
 We can do that with the following filter:
 
-```javascript
+```js
 sanitizeHtml(
   '<p>This is <a href="http://www.linux.org"></a><br/>Linux</p>',
   {
     exclusiveFilter: function(frame) {
-        return frame.tag === 'a' && !frame.text.trim();
+      return frame.tag === 'a' && !frame.text.trim();
     }
   }
 );
@@ -327,7 +336,7 @@ You can also process all text content with a provided filter function. Let's say
 
 We can do that with the following filter:
 
-```javascript
+```js
 sanitizeHtml(
   '<p>some text...</p>',
   {
@@ -350,15 +359,15 @@ These arrays will be checked against the html that is passed to the function and
 
 Make sure to pass a valid hostname along with the domain you wish to allow, i.e.:
 
-```javascript
-  allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
-  allowedIframeDomains: ['zoom.us']
+```js
+allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
+allowedIframeDomains: ['zoom.us']
 ```
 
 You may also specify whether or not to allow relative URLs as iframe sources.
 
-```javascript
-  allowIframeRelativeUrls: true
+```js
+allowIframeRelativeUrls: true
 ```
 
 Note that if unspecified, relative URLs will be allowed by default if no hostname or domain filter is provided but removed by default if a hostname or domain filter is provided.
@@ -367,7 +376,7 @@ Note that if unspecified, relative URLs will be allowed by default if no hostnam
 
 For example:
 
-```javascript
+```js
 clean = sanitizeHtml('<p><iframe src="https://www.youtube.com/embed/nykIhs12345"></iframe><p>', {
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
@@ -382,7 +391,7 @@ clean = sanitizeHtml('<p><iframe src="https://www.youtube.com/embed/nykIhs12345"
 
 will pass through as safe whereas:
 
-```javascript
+```js
 clean = sanitizeHtml('<p><iframe src="https://www.youtube.net/embed/nykIhs12345"></iframe><p>', {
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
@@ -397,7 +406,7 @@ clean = sanitizeHtml('<p><iframe src="https://www.youtube.net/embed/nykIhs12345"
 
 or
 
-```javascript
+```js
 clean = sanitizeHtml('<p><iframe src="https://www.vimeo/video/12345"></iframe><p>', {
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
@@ -414,7 +423,7 @@ will return an empty iframe tag.
 
 If you want to allow any subdomain of any level you can provide the domain in `allowedIframeDomains`
 
-```javascript
+```js
 clean = sanitizeHtml('<p><iframe src="https://us02web.zoom.us/embed/12345"></iframe><p>', {
   allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
   allowedClasses: {
@@ -436,7 +445,7 @@ If you wish to allow specific CSS classes on a particular element, you can do so
 
 This implies that the `class` attribute is allowed on that element.
 
-```javascript
+```js
 // Allow only a restricted set of CSS classes and only on the p tag
 clean = sanitizeHtml(dirty, {
   allowedTags: [ 'p', 'em', 'strong' ],
@@ -456,25 +465,25 @@ If you wish to allow specific CSS _styles_ on a particular element, you can do t
 
 **URLs in inline styles are NOT filtered by any mechanism other than your regular expression.**
 
-```javascript
+```js
 clean = sanitizeHtml(dirty, {
-        allowedTags: ['p'],
-        allowedAttributes: {
-          'p': ["style"],
-        },
-        allowedStyles: {
-          '*': {
-            // Match HEX and RGB
-            'color': [/^#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/],
-            'text-align': [/^left$/, /^right$/, /^center$/],
-            // Match any number with px, em, or %
-            'font-size': [/^\d+(?:px|em|%)$/]
-          },
-          'p': {
-            'font-size': [/^\d+rem$/]
-          }
-        }
-      });
+  allowedTags: ['p'],
+  allowedAttributes: {
+    'p': ["style"],
+  },
+  allowedStyles: {
+    '*': {
+      // Match HEX and RGB
+      'color': [/^#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/],
+      'text-align': [/^left$/, /^right$/, /^center$/],
+      // Match any number with px, em, or %
+      'font-size': [/^\d+(?:px|em|%)$/]
+    },
+    'p': {
+      'font-size': [/^\d+rem$/]
+    }
+  }
+});
 ```
 
 ### Allowed URL schemes
@@ -487,7 +496,7 @@ By default we allow the following URL schemes in cases where `href`, `src`, etc.
 
 You can override this if you want to:
 
-```javascript
+```js
 sanitizeHtml(
   // teeny-tiny valid transparent GIF in a data URL
   '<img src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" />',
@@ -500,7 +509,7 @@ sanitizeHtml(
 
 You can also allow a scheme for a particular tag only:
 
-```javascript
+```js
 allowedSchemes: [ 'http', 'https' ],
 allowedSchemesByTag: {
   img: [ 'data' ]
@@ -509,7 +518,7 @@ allowedSchemesByTag: {
 
 And you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:
 
-```javascript
+```js
 allowProtocolRelative: false
 ```
 
@@ -524,7 +533,7 @@ The exceptions are:
 If you wish to replace this list, for instance to discard whatever is found
 inside a `noscript` tag, use the `nonTextTags` option:
 
-```javascript
+```js
 nonTextTags: [ 'style', 'script', 'textarea', 'option', 'noscript' ]
 ```
 
@@ -540,7 +549,7 @@ disabled with the `allowVulnerableTags: true` option.
 
 Instead of discarding, or keeping text only, you may enable escaping of the entire content:
 
-```javascript
+```js
 disallowedTagsMode: 'escape'
 ```
 
@@ -554,10 +563,10 @@ Valid values are: `'discard'` (default), `'escape'` (escape the tag) and `'recur
 
 ## Changelog
 
-[The changelog is now in a separate file for readability.](https://github.com/apostrophecms/sanitize-html/blob/master/CHANGELOG.md)
+[The changelog is now in a separate file for readability.](https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md)
 
 ## Support
 
 Feel free to open issues on [github](http://github.com/apostrophecms/sanitize-html).
 
-<a href="http://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/sanitize-html/master/logos/logo-box-builtby.png" /></a>
+<a href="http://apostrophecms.com/"><img src="https://raw.githubusercontent.com/apostrophecms/sanitize-html/main/logos/logo-box-builtby.png" /></a>