sanitize-html
Advanced tools
sanitize-html - npm Package Versions
Changelog
2.13.0 (2024-03-20)
-
Documentation update regarding minimum supported TypeScript version.
-
Added disallowedTagsMode:
completelyDiscardoption to remove the content also in HTML. Thanks to Gauav Kumar for this addition.
Changelog
2.12.1 (2024-02-22)
- Do not parse sourcemaps in
post-css. This fixes a vulnerability in which information about the existence or non-existence of files on a server could be disclosed via properly crafted HTML input when thestyleattribute is allowed by the configuration. Thanks to the Snyk Security team for the disclosure and to Dylan Armstrong for the fix.
Changelog
2.12.0 (2024-02-21)
-
Introduced the
allowedEmptyAttributesoption, enabling explicit specification of empty string values for select attributes, with the default attribute set toalt. Thanks to Na for the contribution. -
Clarified the use of SVGs with a new test and changes to documentation. Thanks to Gauav Kumar for the contribution.
-
Do not process source maps when processing style tags with PostCSS.
Changelog
2.11.0 (2023-06-21)
- Fix to allow
falseinallowedClassesattributes. Thanks to Kevin Jiang for this fix! - Upgrade mocha version
- Apply small linter fixes in tests
- Add
.ideatemp files to.gitignore - Thanks to Vitalii Shpital for the updates!
- Show parseStyleAttributes warning in browser only. Thanks to mog422 for this update!
- Remove empty non-boolean attributes via an exhaustive, configurable list of known non-boolean attributes. Thanks to Dylan Armstrong for this update!
Changelog
2.10.0 (2023-02-17)
- Fix auto-adding escaped closing tags. In other words, do not add implied closing tags to disallowed tags when
disallowedTagModeis set to any variant ofescape-- just escape the disallowed tags that are present. This fixes issue #464. Thanks to Daniel Liebner - Add
tagAllowed()helper function which takes a tag name and checks it againstoptions.allowedTagsand returnstrueif the tag is allowed andfalseif it is not.
Changelog
2.9.0 (2023-01-27)
- Add option parseStyleAttributes to skip style parsing. This fixes issue #547. Thanks to Bert Verhelst.
Changelog
2.8.1 (2022-12-21)
- If the argument is a number, convert it to a string, for backwards compatibility. Thanks to Alexander Schranz.
Changelog
2.8.0 (2022-12-12)
- Upgrades
htmlparser2to new major version^8.0.0. Thanks to Kedar Chandrayan for this contribution.
Changelog
2.7.3 (2022-10-24)
- If allowedTags is falsy but not exactly
false, then do not assume that all tags are allowed. Rather, allow no tags in this case, to be on the safe side. This matches the existing documentation and fixes issue #176. Thanks to Kedar Chandrayan for the fix.
Changelog
2.7.2 (2022-09-15)
- Closing tags must agree with opening tags. This fixes issue #549, in which closing tags not associated with any permitted opening tag could be passed through. No known exploit exists, but it's better not to permit this. Thanks to Kedar Chandrayan for the report and the fix.