sanitize-html 2.3.2 → 2.3.3

package/CHANGELOG.md

@@ -1,8 +1,13 @@
 # Changelog
 
+## 2.3.3 (2021-03-19):
+- Security fix: `allowedSchemes` and related options did not properly block schemes containing a hyphen, plus sign, period or digit, such as `ms-calculator:`. Thanks to Lukas Euler for pointing out the issue.
+- Added a security note about the known risks associated with using the `parser` option, especially `decodeEntities: false`. See the documentation.
+
 ## 2.3.2 (2021-01-26):
+
 - Additional fixes for iframe validation exploits. Prevent exploits based on browsers' tolerance of the use of "\" rather than "/" and the presence of whitespace at this point in the URL. Thanks to Ron Masas of [Checkmarx](https://www.checkmarx.com/) for pointing out the issue and writing unit tests.
-- Documentation correction for `yarn` users. Thanks to Tagir Khadzhiev.
+- Updates README `yarn add` syntax. Thanks to [Tagir Khadshiev](https://github.com/Aspedm) for the contribution.
 
 ## 2.3.1 (2021-01-22):
 - Uses the standard WHATWG URL parser to stop IDNA (Internationalized Domain Name) attacks on the iframe hostname validator. Thanks to Ron Masas of [Checkmarx](https://www.checkmarx.com/) for pointing out the issue and suggesting the use of the WHATWG parser.

package/README.md

@@ -274,7 +274,9 @@ enforceHtmlBoundary: true
 
 ### htmlparser2 Options
 
-sanitize-html is built on `htmlparser2`. By default the only option passed down is `decodeEntities: true` You can set the options to pass by using the parser option.
+sanitize-html is built on `htmlparser2`. By default the only option passed down is `decodeEntities: true`. You can set the options to pass by using the parser option.
+
+**Security note: changing the `parser` settings can be risky.** In particular, `decodeEntities: false` has known security concerns and a complete test suite does not exist for every possible combination of settings when used with `sanitize-html`. If security is your goal we recommend you use the defaults rather than changing `parser`, except for the `lowerCaseTags` option.
 
 ```javascript
 const clean = sanitizeHtml(dirty, {

package/index.js

@@ -568,7 +568,9 @@ function sanitizeHtml(html, options, _recursing) {
     // a javascript: URL to be snuck through
     href = href.replace(/<!--.*?-->/g, '');
     // Case insensitive so we don't get faked out by JAVASCRIPT #1
-    const matches = href.match(/^([a-zA-Z]+):/);
+    // Allow more characters after the first so we don't get faked
+    // out by certain schemes browsers accept
+    const matches = href.match(/^([a-zA-Z][a-zA-Z0-9.\-+]*):/);
     if (!matches) {
       // Protocol-relative URL starting with any combination of '/' and '\'
       if (href.match(/^[/\\]{2}/)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "description": "Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",