sanitize-html 2.17.5-alpha.1 → 2.17.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -1
- package/index.js +10 -3
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -182,7 +182,14 @@ selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', '
|
|
|
182
182
|
// URL schemes we permit
|
|
183
183
|
allowedSchemes: [ 'http', 'https', 'ftp', 'mailto', 'tel' ],
|
|
184
184
|
allowedSchemesByTag: {},
|
|
185
|
-
allowedSchemesAppliedToAttributes: [
|
|
185
|
+
allowedSchemesAppliedToAttributes: [
|
|
186
|
+
'href', 'src', 'cite',
|
|
187
|
+
'action', 'formaction', 'data', 'xlink:href',
|
|
188
|
+
'poster', 'background', 'ping',
|
|
189
|
+
'longdesc', 'usemap', 'codebase', 'classid', 'archive',
|
|
190
|
+
'profile', 'manifest', 'itemid',
|
|
191
|
+
'dynsrc', 'lowsrc'
|
|
192
|
+
],
|
|
186
193
|
allowProtocolRelative: true,
|
|
187
194
|
enforceHtmlBoundary: false,
|
|
188
195
|
parseStyleAttributes: true
|
package/index.js
CHANGED
|
@@ -440,11 +440,11 @@ function sanitizeHtml(html, options, _recursing) {
|
|
|
440
440
|
return;
|
|
441
441
|
}
|
|
442
442
|
}
|
|
443
|
-
if (a === 'srcset') {
|
|
443
|
+
if (a === 'srcset' || a === 'imagesrcset') {
|
|
444
444
|
try {
|
|
445
445
|
let parsed = parseSrcset(value);
|
|
446
446
|
parsed.forEach(function(value) {
|
|
447
|
-
if (naughtyHref(
|
|
447
|
+
if (naughtyHref(a, value.url)) {
|
|
448
448
|
value.evil = true;
|
|
449
449
|
}
|
|
450
450
|
});
|
|
@@ -957,7 +957,14 @@ sanitizeHtml.defaults = {
|
|
|
957
957
|
// URL schemes we permit
|
|
958
958
|
allowedSchemes: [ 'http', 'https', 'ftp', 'mailto', 'tel' ],
|
|
959
959
|
allowedSchemesByTag: {},
|
|
960
|
-
allowedSchemesAppliedToAttributes: [
|
|
960
|
+
allowedSchemesAppliedToAttributes: [
|
|
961
|
+
'href', 'src', 'cite',
|
|
962
|
+
'action', 'formaction', 'data', 'xlink:href',
|
|
963
|
+
'poster', 'background', 'ping',
|
|
964
|
+
'longdesc', 'usemap', 'codebase', 'classid', 'archive',
|
|
965
|
+
'profile', 'manifest', 'itemid',
|
|
966
|
+
'dynsrc', 'lowsrc'
|
|
967
|
+
],
|
|
961
968
|
allowProtocolRelative: true,
|
|
962
969
|
enforceHtmlBoundary: false,
|
|
963
970
|
parseStyleAttributes: true,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "sanitize-html",
|
|
3
|
-
"version": "2.17.5
|
|
3
|
+
"version": "2.17.5",
|
|
4
4
|
"description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
|
|
5
5
|
"sideEffects": false,
|
|
6
6
|
"main": "index.js",
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
"is-plain-object": "^5.0.0",
|
|
29
29
|
"parse-srcset": "^1.0.2",
|
|
30
30
|
"postcss": "^8.3.11",
|
|
31
|
-
"launder": "^1.7.
|
|
31
|
+
"launder": "^1.7.1"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
34
|
"eslint": "^9.39.1",
|