sanitize-html 2.17.7 → 2.18.0

package/README.md

@@ -810,6 +810,20 @@ nestingLimit: 6
 
 This will prevent the user from nesting tags more than 6 levels deep. Tags deeper than that are stripped out exactly as if they were disallowed. Note that this means text is preserved in the usual ways where appropriate.
 
+### Routing warnings to your own logger
+
+sanitize-html writes its own diagnostics - the vulnerable tag notice above, and the style parsing notice in the browser - to the console. If your application has a logging pipeline of its own, pass any console-shaped object as the `logger` option and they are delivered to it instead:
+
+```javascript
+sanitizeHtml(dirty, {
+  logger: myLogger // an object with debug, info, warn and error methods
+});
+```
+
+Any of the four methods that your object does not provide falls back to the console, and without the option at all the console is still the destination, exactly as before.
+
+This matters for applications that write structured logs: a raw `console.warn` bypasses their filtering and formatting, and puts unparseable text on a stream that is expected to be one JSON object per line.
+
 ### Advanced filtering
 
 For more advanced filtering you can hook directly into the parsing process using tag open and tag close events.

package/index.js

@@ -24,6 +24,22 @@ const svgAnimationTags = [
 // `href` are covered.
 const alwaysUrlAttributes = [ 'href' ];
 
+// Our own diagnostics. A console-shaped `logger` option takes them instead of
+// the console; missing methods fall back to it.
+const severities = [ 'debug', 'info', 'warn', 'error' ];
+
+function loggerFor(options) {
+  const source = (options && options.logger) || console;
+  const logger = {};
+  for (const severity of severities) {
+    logger[severity] = typeof source[severity] === 'function'
+      ? (...args) => source[severity](...args)
+      // eslint-disable-next-line no-console
+      : (...args) => console[severity](...args);
+  }
+  return logger;
+}
+
 function each(obj, cb) {
   if (obj) {
     Object.keys(obj).forEach(function (key) {
@@ -131,6 +147,8 @@ function sanitizeHtml(html, options, _recursing) {
   options = Object.assign({}, sanitizeHtml.defaults, options);
   options.parser = Object.assign({}, htmlParserDefaults, options.parser);
 
+  const logger = loggerFor(options);
+
   const tagAllowed = function (name) {
     return options.allowedTags === false ||
       (options.allowedTags || []).indexOf(name) > -1;
@@ -139,7 +157,12 @@ function sanitizeHtml(html, options, _recursing) {
   // vulnerableTags
   vulnerableTags.forEach(function (tag) {
     if (tagAllowed(tag) && !options.allowVulnerableTags) {
-      console.warn(`\n\n⚠️ Your \`allowedTags\` option includes, \`${tag}\`, which is inherently\nvulnerable to XSS attacks. Please remove it from \`allowedTags\`.\nOr, to disable this warning, add the \`allowVulnerableTags\` option\nand ensure you are accounting for this risk.\n\n`);
+      logger.warn(
+        `Your \`allowedTags\` option includes \`${tag}\`, which is inherently ` +
+        'vulnerable to XSS attacks. Please remove it from `allowedTags`, or, ' +
+        'to disable this warning, add the `allowVulnerableTags` option and ' +
+        'ensure you are accounting for this risk.'
+      );
     }
   });
 
@@ -233,6 +256,15 @@ function sanitizeHtml(html, options, _recursing) {
   let transformMap;
   let skipText;
   let skipTextDepth;
+  // Browsers (with scripting enabled) parse <noscript> content as raw text up
+  // to the first `</noscript`, but htmlparser2 parses it as markup, so an end
+  // tag for an ancestor can make htmlparser2 close the <noscript> implicitly
+  // much earlier. `rawTextEnd` is the source offset where the browser ends the
+  // <noscript> being discarded, and `skipRawText` is set while htmlparser2 has
+  // already closed it but the browser has not, so that we keep discarding
+  // until we reach that offset (GHSA-x3q4-9hxx-gx8m).
+  let rawTextEnd;
+  let skipRawText;
   let addedText = false;
 
   initializeState();
@@ -242,6 +274,7 @@ function sanitizeHtml(html, options, _recursing) {
       if (options.onOpenTag) {
         options.onOpenTag(name, attribs);
       }
+      updateRawTextRegion();
 
       // If `enforceHtmlBoundary` is `true` and this has found the opening
       // `html` tag, reset the state.
@@ -249,6 +282,9 @@ function sanitizeHtml(html, options, _recursing) {
         initializeState();
       }
 
+      if (skipRawText) {
+        return;
+      }
       if (skipText) {
         skipTextDepth++;
         return;
@@ -290,6 +326,9 @@ function sanitizeHtml(html, options, _recursing) {
           if (nonTextTagsArray.indexOf(name) !== -1) {
             skipText = true;
             skipTextDepth = 1;
+            if (frame.tag.toLowerCase() === 'noscript') {
+              rawTextEnd = findRawTextEnd('noscript', parser.endIndex + 1);
+            }
           }
         }
       }
@@ -389,6 +428,14 @@ function sanitizeHtml(html, options, _recursing) {
               }
             }
 
+            // `<meta http-equiv="refresh" content="0;url=...">` navigates to a
+            // URL embedded in `content`, so scheme check that URL too
+            // (GHSA-cv27-6wvh-8x7j). Other meta `content` values are left alone.
+            if (name === 'meta' && a.toLowerCase() === 'content' && isRefresh(attribs) && naughtyRefresh(value)) {
+              delete frame.attribs[a];
+              return;
+            }
+
             if (name === 'script' && a === 'src') {
 
               let allowed = true;
@@ -455,7 +502,7 @@ function sanitizeHtml(html, options, _recursing) {
               try {
                 let parsed = parseSrcset(value);
                 parsed.forEach(function(value) {
-                  if (naughtyHref(a, value.url)) {
+                  if (naughtyHref(name, value.url)) {
                     value.evil = true;
                   }
                 });
@@ -527,7 +574,14 @@ function sanitizeHtml(html, options, _recursing) {
                   }
                 } catch (e) {
                   if (typeof window !== 'undefined') {
-                    console.warn('Failed to parse "' + name + ' {' + value + '}' + '", If you\'re running this in a browser, we recommend to disable style parsing: options.parseStyleAttributes: false, since this only works in a node environment due to a postcss dependency, More info: https://github.com/apostrophecms/sanitize-html/issues/547');
+                    logger.warn(
+                      `Failed to parse "${name} {${value}}". If you are ` +
+                      'running this in a browser, we recommend disabling ' +
+                      'style parsing with the parseStyleAttributes option, ' +
+                      'since it only works in a node environment due to a ' +
+                      'postcss dependency. More info: ' +
+                      'https://github.com/apostrophecms/sanitize-html/issues/547'
+                    );
                   }
                   delete frame.attribs[a];
                   return;
@@ -568,7 +622,8 @@ function sanitizeHtml(html, options, _recursing) {
       frame.openingTagLength = result.length - frame.tagPosition;
     },
     ontext: function(text) {
-      if (skipText) {
+      updateRawTextRegion();
+      if (skipText || skipRawText) {
         return;
       }
       const lastFrame = stack[stack.length - 1];
@@ -622,6 +677,16 @@ function sanitizeHtml(html, options, _recursing) {
         // htmlparser2, so their contents are decoded and must be escaped below
         // like any other text (important to prevent XSS via entity-encoded
         // payloads such as <option>&lt;script&gt;...&lt;/script&gt;</option>).
+      } else if (
+        // htmlparser2 treats <iframe> as a raw-text element, so markup inside
+        // (including after an unclosed <iframe>) arrives as a single text node.
+        // When the iframe is discarded, re-sanitize that fallback markup as HTML
+        // instead of escaping it as plain text (issue #5550).
+        tag === 'iframe' &&
+        !tagAllowed(tag) &&
+        options.disallowedTagsMode === 'discard'
+      ) {
+        result += sanitizeHtml(text, options);
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
         if (options.textFilter) {
@@ -640,10 +705,24 @@ function sanitizeHtml(html, options, _recursing) {
         options.onCloseTag(name, isImplied);
       }
 
-      if (skipText) {
+      updateRawTextRegion();
+      if (skipRawText) {
+        // Still inside the browser's raw text: only close elements that were
+        // opened before the discarded region, so the output stays balanced.
+        const lastFrame = stack[stack.length - 1];
+        if (!lastFrame || lastFrame.tag !== name) {
+          return;
+        }
+      } else if (skipText) {
         skipTextDepth--;
         if (!skipTextDepth) {
           skipText = false;
+          if (rawTextEnd !== null) {
+            // htmlparser2 closed the element implicitly (e.g. an ancestor's
+            // end tag) before the browser would. Close its frame below, but
+            // keep discarding up to the browser's end tag.
+            skipRawText = true;
+          }
         } else {
           return;
         }
@@ -746,6 +825,27 @@ function sanitizeHtml(html, options, _recursing) {
     transformMap = {};
     skipText = false;
     skipTextDepth = 0;
+    rawTextEnd = null;
+    skipRawText = false;
+  }
+
+  // Leave the raw text region once the parser reaches the offset where the
+  // browser ends it.
+  function updateRawTextRegion() {
+    if (rawTextEnd !== null && parser.startIndex >= rawTextEnd) {
+      rawTextEnd = null;
+      skipRawText = false;
+    }
+  }
+
+  // Offset of the end tag that ends a raw text element in a browser: the
+  // first case-insensitive `</name` followed by HTML whitespace, `/` or `>`.
+  // With no such end tag the element runs to the end of the input.
+  function findRawTextEnd(tagName, from) {
+    const re = new RegExp('</' + tagName + '[\\t\\n\\f\\r />]', 'ig');
+    re.lastIndex = from;
+    const match = re.exec(html);
+    return match ? match.index : Infinity;
   }
 
   function escapeHtml(s, quote) {
@@ -784,6 +884,86 @@ function sanitizeHtml(html, options, _recursing) {
     });
   }
 
+  function isRefresh(attribs) {
+    return Object.keys(attribs).some(function(a) {
+      return a.toLowerCase() === 'http-equiv' &&
+        String(attribs[a]).trim().toLowerCase() === 'refresh';
+    });
+  }
+
+  // True if the `content` of a `<meta http-equiv="refresh">` must be dropped:
+  // its destination URL fails the scheme policy, or it cannot be parsed as a
+  // refresh at all (a browser would ignore it then, so nothing is lost).
+  // Extracts the URL the way the HTML standard's "shared declarative refresh
+  // steps" do, so that spelling, separator, quoting and case variations of
+  // `url=`, or no `url=` at all, all yield the URL a browser would navigate to.
+  function naughtyRefresh(content) {
+    const input = String(content);
+    const isWhitespace = function(c) {
+      return c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
+    };
+    let position = 0;
+    const skipWhitespace = function() {
+      while (position < input.length && isWhitespace(input[position])) {
+        position++;
+      }
+    };
+    const lowerAt = function(i) {
+      return (input[i] || '').toLowerCase();
+    };
+    skipWhitespace();
+    const timeStart = position;
+    while (position < input.length && /[0-9.]/.test(input[position])) {
+      position++;
+    }
+    if (position === timeStart) {
+      return true;
+    }
+    if (position < input.length) {
+      const c = input[position];
+      if (c !== ';' && c !== ',' && !isWhitespace(c)) {
+        return true;
+      }
+      skipWhitespace();
+      if (input[position] === ';' || input[position] === ',') {
+        position++;
+      }
+      skipWhitespace();
+    }
+    if (position >= input.length) {
+      // No URL: refreshes the current document
+      return false;
+    }
+    let url = input.slice(position);
+    let quoted = true;
+    if (lowerAt(position) === 'u') {
+      quoted = false;
+      if (lowerAt(position + 1) === 'r' && lowerAt(position + 2) === 'l') {
+        position += 3;
+        skipWhitespace();
+        if (input[position] === '=') {
+          position++;
+          skipWhitespace();
+          quoted = true;
+        }
+      }
+    }
+    if (quoted) {
+      const quote = input[position];
+      if (quote === '"' || quote === '\'') {
+        position++;
+      }
+      url = input.slice(position);
+      if (quote === '"' || quote === '\'') {
+        const end = url.indexOf(quote);
+        if (end !== -1) {
+          url = url.slice(0, end);
+        }
+      }
+    }
+    return naughtyHref('meta', url);
+  }
+
   // True if this is an SVG SMIL animation element that animates a URL-bearing
   // attribute, e.g. `<animate attributeName="href" values="#safe;javascript:...">`.
   //
@@ -799,12 +979,14 @@ function sanitizeHtml(html, options, _recursing) {
   // animation on the strength of its target instead. Animations of attributes
   // that are not URL sinks, such as `fill` or `opacity`, are unaffected.
   function animatesUrlAttribute(name, attribs) {
-    if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {
+    // In an XML serialization a prefixed name such as `svg:animate` is the same
+    // element as `animate`, so match on the local name (GHSA-374f-7chj-9948).
+    if (svgAnimationTags.indexOf(localPart(name)) === -1) {
       return false;
     }
     const schemeCheckedAttributes = options.allowedSchemesAppliedToAttributes || [];
     return Object.keys(attribs || {}).some(function(attributeName) {
-      if (attributeName.toLowerCase() !== 'attributename') {
+      if (localPart(attributeName) !== 'attributename') {
         return false;
       }
       const target = (attribs[attributeName] || '').trim().toLowerCase();
@@ -817,6 +999,12 @@ function sanitizeHtml(html, options, _recursing) {
     });
   }
 
+  // Lowercased name with any namespace prefix removed.
+  function localPart(name) {
+    const lower = name.toLowerCase();
+    return lower.slice(lower.lastIndexOf(':') + 1);
+  }
+
   function parseUrl(value) {
     value = value.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, '$1//');
     if (value.startsWith('relative:')) {

package/package.json

@@ -1,12 +1,16 @@
 {
   "name": "sanitize-html",
-  "version": "2.17.7",
+  "version": "2.18.0",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",
   "files": [
     "index.js"
   ],
+  "scripts": {
+    "test": "npm run lint && mocha",
+    "lint": "eslint ."
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/apostrophecms/apostrophe.git",
@@ -25,25 +29,21 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "deepmerge": "^4.2.2",
+    "deepmerge": "^4.3.1",
     "escape-string-regexp": "^4.0.0",
     "htmlparser2": "^12.0.0",
-    "is-plain-object": "^5.0.0",
+    "is-plain-object": "^5.1.0",
+    "launder": "^1.7.2",
     "parse-srcset": "^1.0.2",
-    "postcss": "^8.3.11",
-    "launder": "^1.7.1"
+    "postcss": "^8.5.27"
   },
   "devDependencies": {
-    "eslint": "^9.39.1",
-    "mocha": "^11.7.5",
-    "sinon": "^9.0.2",
-    "eslint-config-apostrophe": "^6.0.2"
+    "eslint": "^9.39.5",
+    "eslint-config-apostrophe": "^6.1.0",
+    "mocha": "^11.8.0",
+    "sinon": "^9.2.4"
   },
   "apostropheTestConfig": {
     "requiresMongo": false
-  },
-  "scripts": {
-    "test": "npm run lint && mocha",
-    "lint": "eslint ."
   }
-}
+}