apostrophecms / sanitize-html

Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
MIT License
3.68k stars 349 forks source link

Bug Fix: allow false in allowedClasses #623

Closed KevinSJ closed 1 year ago

KevinSJ commented 1 year ago

Summary

Prior to 2.4.0, allowedClasses can be false, this has been an undocumented feature. Since 2.4.0, this behavior is broken. This PR reverted to the previous behavior where false is allowed in the allowedClasses attribute.

See https://github.com/apostrophecms/sanitize-html/discussions/621 for more detail

What are the specific steps to test this change?

The following code is broken in the main branch of this base repo, but should work in the branch in this pr.

const sanitizeHtml = require('sanitize-html');

const ALLOWED_TAGS = [
    'li',
    'ul',
    'ol',
    'p',
    'h1',
    'h2',
    'h3',
    'h4',
    'h5',
    'h6',
    'img',
    'a',
    'div',
    'b',
    'table',
    'tbody',
    'tr',
    'th',
    'td'
];
const ALLOWED_SCHEMES = ['https', 'mailto'];

const sanitized = sanitizeHtml(`<ul class="should not sanitize"><li>Hello </li></ul>`, {
    allowedAttributes: { '*': ['*'] },
    allowedTags: ALLOWED_TAGS,
    allowedClasses: {
        ul: false
    },
    allowProtocolRelative: false,
    allowedSchemes: ALLOWED_SCHEMES
});
//expected <ul class="should not sanitize"><li>Hello </li></ul>
console.log(sanitized)

What kind of change does this PR introduce?

(Check at least one)

Make sure the PR fulfills these requirements:

Other information:

KevinSJ commented 1 year ago

@boutell would you be able to merge this?