Additional fixes for iframe validation exploits. Prevent exploits based on browsers' tolerance of the use of "" rather than "/" and the presence of whitespace at this point in the URL. Thanks to Ron Masas of Checkmarx for pointing out the issue and writing unit tests.
Updates README yarn add syntax. Thanks to Tagir Khadshiev for the contribution.
2.3.1 (2021-01-22):
Uses the standard WHATWG URL parser to stop IDNA (Internationalized Domain Name) attacks on the iframe hostname validator. Thanks to Ron Masas of Checkmarx for pointing out the issue and suggesting the use of the WHATWG parser.
2.3.0 (2020-12-16):
Upgrades htmlparser2 to new major version ^6.0.0. Thanks to Bogdan Chadkin for the contribution.
2.2.0 (2020-12-02):
Adds a note to the README about Typescript support (or the lack-thereof).
Adds tel to the default allowedSchemes. Thanks to Arne Herbots for this contribution.
2.1.2 (2020-11-04):
Fixes typos and inconsistencies in the README. Thanks to Eric Lefevre-Ardant for this contribution.
2.1.1 (2020-10-21):
Fixes a bug when using allowedClasses with an '*' wildcard selector. Thanks to Clemens Damke for this contribution.
Updates mocha to 7.x to resolve security warnings.
2.1.0 (2020-10-07):
sup added to the default allowed tags list. Thanks to Julian Lam for the contribution.
Updates default allowedTags README documentation. Thanks to Marco Arduini for the contribution.
2.0.0 (2020-09-23):
nestingLimit option added.
Updates ESLint config package and fixes warnings.
Upgrade is-plain-object package with named export. Thanks to Bogdan Chadkin for the contribution.
Upgrade postcss package and drop Node 11 and Node 13 support (enforced by postcss).
Backwards compatibility breaks:
There is no build. You should no longer directly link to a sanitize-html file directly in the browser as it is using modern Javascript that is not fully supported by all major browsers (depending on your definition). You should now include sanitize-html in your project build for this purpose if you have one.
On the server side, Node.js 10 or higher is required.
The default allowedTags array was updated significantly. This mostly added HTML tags to be more comprehensive by default. You should review your projects and consider the allowedTags defaults if you are not already overriding them.
2.0.0-rc.2 (2020-09-09):
Always use existing has function rather than duplicating it.
2.0.0-rc.1 (2020-08-26):
Upgrade klona package. Thanks to Bogdan Chadkin for the contribution.
2.0.0-beta.2:
Add files to package.json to prevent publishing unnecessary files to npm #392. Thanks to styfle for the contribution.
Removes iframe and nl from default allowed tags. Adds most innocuous tags to the default allowedTags array.
Fixes a bug when using transformTags with out textFilter. Thanks to Andrzej Porebski for the help with a failing test.
2.0.0-beta:
Moves the index.js file to the project root and removes all build steps within the package. Going forward, it is up to the developer to include sanitize-html in their project builds as-needed. This removes major points of conflict with project code and frees this module to not worry about myriad build-related questions.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TechAndCheck/tech-and-check-alerts/network/alerts).
⚠️ Dependabot is rebasing this PR ⚠️
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps sanitize-html from 1.20.1 to 2.3.2.
Changelog
Sourced from sanitize-html's changelog.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TechAndCheck/tech-and-check-alerts/network/alerts).