Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug Fix: allow false in allowedClasses #623

Merged
merged 3 commits into from
Jun 13, 2023
Merged

Conversation

KevinSJ
Copy link
Contributor

@KevinSJ KevinSJ commented May 26, 2023

Summary

Prior to 2.4.0, allowedClasses can be false, this has been an undocumented feature.
Since 2.4.0, this behavior is broken. This PR reverted to the previous behavior where false is allowed in the allowedClasses attribute.

See #621 for more detail

What are the specific steps to test this change?

The following code is broken in the main branch of this base repo, but should work in the branch in this pr.

const sanitizeHtml = require('sanitize-html');

const ALLOWED_TAGS = [
    'li',
    'ul',
    'ol',
    'p',
    'h1',
    'h2',
    'h3',
    'h4',
    'h5',
    'h6',
    'img',
    'a',
    'div',
    'b',
    'table',
    'tbody',
    'tr',
    'th',
    'td'
];
const ALLOWED_SCHEMES = ['https', 'mailto'];

const sanitized = sanitizeHtml(`<ul class="should not sanitize"><li>Hello </li></ul>`, {
    allowedAttributes: { '*': ['*'] },
    allowedTags: ALLOWED_TAGS,
    allowedClasses: {
        ul: false
    },
    allowProtocolRelative: false,
    allowedSchemes: ALLOWED_SCHEMES
});
//expected <ul class="should not sanitize"><li>Hello </li></ul>
console.log(sanitized)

What kind of change does this PR introduce?

(Check at least one)

  • Bug fix
  • New feature
  • Refactor
  • Documentation
  • Build-related changes
  • Other

Make sure the PR fulfills these requirements:

  • It includes a) the existing issue ID being resolved, b) a convincing reason for adding this feature, or c) a clear description of the bug it resolves
  • The changelog is updated
  • Related documentation has been updated
  • Related tests have been updated

Other information:

@KevinSJ
Copy link
Contributor Author

KevinSJ commented Jun 13, 2023

@boutell would you be able to merge this?

@boutell boutell merged commit 7df9d8b into apostrophecms:main Jun 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants