sanitize-html 2.6.1 → 2.7.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.7.0 (2022-02-04)
+
+- Allows a more sensible set of default attributes on `<img />` tags. Thanks to [Zade Viggers](https://github.com/zadeviggers).
+
 ## 2.6.1 (2021-12-08)
 
 - Fixes style filtering to retain `!important` when used.

package/README.md

@@ -128,10 +128,9 @@ allowedTags: [
 disallowedTagsMode: 'discard',
 allowedAttributes: {
   a: [ 'href', 'name', 'target' ],
-  // We don't currently allow img itself by default, but this
-  // would make sense if we did. You could add srcset here,
-  // and if you do the URL is checked for safety
-  img: [ 'src' ]
+  // We don't currently allow img itself by default, but
+  // these attributes would make sense if we did.
+  img: [ 'src', 'srcset', 'alt', 'title', 'width', 'height', 'loading' ]
 },
 // Lots of these won't come up by default because we don't allow them
 selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],

package/index.js

@@ -780,10 +780,9 @@ sanitizeHtml.defaults = {
   disallowedTagsMode: 'discard',
   allowedAttributes: {
     a: [ 'href', 'name', 'target' ],
-    // We don't currently allow img itself by default, but this
-    // would make sense if we did. You could add srcset here,
-    // and if you do the URL is checked for safety
-    img: [ 'src' ]
+    // We don't currently allow img itself by default, but
+    // these attributes would make sense if we did.
+    img: [ 'src', 'srcset', 'alt', 'title', 'width', 'height', 'loading' ]
   },
   // Lots of these won't come up by default because we don't allow them
   selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.6.1",
+  "version": "2.7.0",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",