filterhtml - npm Package Compare versions

Comparing version 0.3.3 to 0.3.4

lib/FilterHTML.js

@@ -787,2 +787,6 @@ var FilterHTML = (function() {
 
+      if (this.allowed_schemes.indexOf('//') < 0 && url.charAt(0) === '/' && url.charAt(1) === '/') {
+        return '#'; // disallow protocol-relative URLs (possible XSS vector)
+      }
+
       parts = url.split(':');
@@ -789,0 +793,0 @@ scheme = '';

package.json

@@ -5,3 +5,3 @@ {
   "description": "FilterHTML: A whitelisting HTML filter for Python and JavaScript",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "repository": {
@@ -8,0 +8,0 @@ "url": "https://github.com/dcollien/FilterHTML"

Readme.md

@@ -87,4 +87,5 @@ FilterHTML
 
+
  e.g.
-
+<pre>
     {
@@ -102,3 +103,2 @@ 'div': {
       },
-
       'span': {
@@ -112,3 +112,3 @@ # class filtering (a list of allowed matches, strings, regex or functions):
     }
-
+</pre>
 ### Text filtering/modification
@@ -115,0 +115,0 @@ - Text (between tags) can be filtered or modified with a delegate function. This function is passed each string of text between tags, as well as a list of the tags this string is inside (and their attributes). The string is replaced with the output of this function, and it is also filtered according to the supplied white-list specification.

No alert changes

Improved metrics

Total package byte prevSize

36647

increased by0.55%

Lines of code

1014

increased by0.3%

No dependency changes