Sanitize img / src does not work

[jochenonline]

I am doing this:

var xss = require("xss")
var options = {
  whiteList: {
    img: ["src"]
  }
};
console.log(xss('<img src="data:image/gif;base64,R0lGODdhEAAQAMwAAP">', options))

=> "<img src>"

How can I get the string after src?

[leizongmin]

It does not allow the value starts with data: in src attribute by default. See this issue: https://github.com/leizongmin/js-xss/issues/118

You may specify a custom onIgnoreTagAttr function to allow data:* src.