sanitize-html - npm Package Versions

1.1.3:

moved to lodash. 1.1.2 pointed to the wrong version of lodash.

1.1.0:

the transformTags option was added. Thanks to kl3ryk.

1.0.3:

fixed several more javascript URL attack vectors after studying the XSS filter evasion cheat sheet to better understand my enemy. Whitespace characters (codes from 0 to 32), which browsers ignore in URLs in certain cases allowing the "javascript" scheme to be snuck in, are now stripped out when checking for naughty URLs. Thanks again to pinpickle.

1.0.2:

fixed a javascript URL attack vector. naughtyHref must entity-decode URLs and also check for mixed-case scheme names. Thanks to pinpickle.

1.0.1:

Doc tweaks.

1.0.0:

If the style tag is disallowed, then its content should be dumped, so that it doesn't appear as text. We were already doing this for script tags, however in both cases the content is now preserved if the tag is explicitly allowed.

We're rocking our tests and have been working great in production for months, so: declared 1.0.0 stable.

0.1.3:

do not double-escape entities in attributes or text. Turns out the "text" provided by htmlparser2 is already escaped.