4 |
5 | sanitize-html provides a simple HTML sanitizer with a clear API.
6 |
7 | sanitize-html is tolerant. It is well suited for cleaning up HTML fragments such as those created by CKEditor and other rich text editors. It is especially handy for removing unwanted CSS when copying and pasting from Word.
8 |
9 | sanitize-html allows you to specify the tags you want to permit, and the permitted
10 | attributes for each of those tags. If an attribute is a known non-boolean value,
11 | and it is empty, it will be removed. For example `checked` can be empty, but `href`
12 | cannot.
13 |
14 | If a tag is not permitted, the contents of the tag are not discarded. There are
15 | some exceptions to this, discussed below in the "Discarding the entire contents
16 | of a disallowed tag" section.
17 |
18 | The syntax of poorly closed `p` and `img` elements is cleaned up.
19 |
20 | `href` attributes are validated to ensure they only contain `http`, `https`, `ftp` and `mailto` URLs. Relative URLs are also allowed. Ditto for `src` attributes.
21 |
22 | Allowing particular urls as a `src` to an iframe tag by filtering hostnames is also supported.
23 |
24 | HTML comments are not preserved.
25 | Additionally, `sanitize-html` escapes _ALL_ text content - this means that ampersands, greater-than, and less-than signs are converted to their equivalent HTML character references (`&` --> `&`, `<` --> `<`, and so on). Additionally, in attribute values, quotation marks are escaped as well (`"` --> `"`).
26 |
27 | ## Requirements
28 |
29 | sanitize-html is intended for use with Node.js and supports Node 10+. All of its npm dependencies are pure JavaScript. sanitize-html is built on the excellent `htmlparser2` module.
30 |
31 | ### Regarding TypeScript
32 |
33 | sanitize-html is not written in TypeScript and there is no plan to directly support it. There is a community supported typing definition, [`@types/sanitize-html`](https://www.npmjs.com/package/@types/sanitize-html), however.
34 | ```bash
35 | npm install -D @types/sanitize-html
36 | ```
37 | If `esModuleInterop=true` is not set in your `tsconfig.json` file, you have to import it with:
38 |
39 | ```javascript
40 | import * as sanitizeHtml from 'sanitize-html';
41 | ```
42 |
43 | When using TypeScript, there is a minimum supported version of >=4.5 because of a dependency on the `htmlparser2` types.
44 |
45 | Any questions or problems while using `@types/sanitize-html` should be directed to its maintainers as directed by that project's contribution guidelines.
46 |
47 | ## How to use
48 |
49 | ### Browser
50 |
51 | *Think first: why do you want to use it in the browser?* Remember, *servers must never trust browsers.* You can't sanitize HTML for saving on the server anywhere else but on the server.
52 |
53 | But, perhaps you'd like to display sanitized HTML immediately in the browser for preview. Or ask the browser to do the sanitization work on every page load. You can if you want to!
54 |
55 | * Install the package:
56 |
57 | ```bash
58 | npm install sanitize-html
59 | ```
60 | or
61 | ```
62 | yarn add sanitize-html
63 | ```
64 |
65 | The primary change in the 2.x version of sanitize-html is that it no longer includes a build that is ready for browser use. Developers are expected to include sanitize-html in their project builds (e.g., webpack) as they would any other dependency. So while sanitize-html is no longer ready to link to directly in HTML, developers can now more easily process it according to their needs.
66 |
67 | Once built and linked in the browser with other project Javascript, it can be used to sanitize HTML strings in front end code:
68 |
69 | ```javascript
70 | import sanitizeHtml from 'sanitize-html';
71 |
72 | const html = "hello world";
73 | console.log(sanitizeHtml(html));
74 | console.log(sanitizeHtml("some text...
524 | ``` 525 | 526 | We can do that with the following filter: 527 | 528 | ```js 529 | sanitizeHtml( 530 | 'some text...
', 531 | { 532 | textFilter: function(text, tagName) { 533 | if (['a'].indexOf(tagName) > -1) return //Skip anchor tags 534 | 535 | return text.replace(/\.\.\./, '…'); 536 | } 537 | } 538 | ); 539 | ``` 540 | 541 | Note that the text passed to the `textFilter` method is already escaped for safe display as HTML. You may add markup and use entity escape sequences in your `textFilter`. 542 | 543 | ### Iframe Filters 544 | 545 | If you would like to allow iframe tags but want to control the domains that are allowed through, you can provide an array of hostnames and/or array of domains that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the sanitize-html function. 546 | 547 | These arrays will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames or domains in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe. 548 | 549 | Make sure to pass a valid hostname along with the domain you wish to allow, i.e.: 550 | 551 | ```js 552 | allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'], 553 | allowedIframeDomains: ['zoom.us'] 554 | ``` 555 | 556 | You may also specify whether or not to allow relative URLs as iframe sources. 557 | 558 | ```js 559 | allowIframeRelativeUrls: true 560 | ``` 561 | 562 | Note that if unspecified, relative URLs will be allowed by default if no hostname or domain filter is provided but removed by default if a hostname or domain filter is provided. 563 | 564 | **Remember that the `iframe` tag must be allowed as well as the `src` attribute.** 565 | 566 | For example: 567 | 568 | ```javascript 569 | const clean = sanitizeHtml('', { 570 | allowedTags: [ 'p', 'em', 'strong', 'iframe' ], 571 | allowedClasses: { 572 | 'p': [ 'fancy', 'simple' ], 573 | }, 574 | allowedAttributes: { 575 | 'iframe': ['src'] 576 | }, 577 | allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'] 578 | }); 579 | ``` 580 | 581 | will pass through as safe whereas: 582 | 583 | ```javascript 584 | const clean = sanitizeHtml('
', { 585 | allowedTags: [ 'p', 'em', 'strong', 'iframe' ], 586 | allowedClasses: { 587 | 'p': [ 'fancy', 'simple' ], 588 | }, 589 | allowedAttributes: { 590 | 'iframe': ['src'] 591 | }, 592 | allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'] 593 | }); 594 | ``` 595 | 596 | or 597 | 598 | ```javascript 599 | const clean = sanitizeHtml('
', { 600 | allowedTags: [ 'p', 'em', 'strong', 'iframe' ], 601 | allowedClasses: { 602 | 'p': [ 'fancy', 'simple' ], 603 | }, 604 | allowedAttributes: { 605 | 'iframe': ['src'] 606 | }, 607 | allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'] 608 | }); 609 | ``` 610 | 611 | will return an empty iframe tag. 612 | 613 | If you want to allow any subdomain of any level you can provide the domain in `allowedIframeDomains` 614 | 615 | ```javascript 616 | // This iframe markup will pass through as safe. 617 | const clean = sanitizeHtml('
', {
618 | allowedTags: [ 'p', 'em', 'strong', 'iframe' ],
619 | allowedClasses: {
620 | 'p': [ 'fancy', 'simple' ],
621 | },
622 | allowedAttributes: {
623 | 'iframe': ['src']
624 | },
625 | allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],
626 | allowedIframeDomains: ['zoom.us']
627 | });
628 | ```
629 |
630 | ### Script Filters
631 |
632 | Similarly to iframes you can allow a script tag on a list of allowlisted domains
633 |
634 | ```js
635 | const clean = sanitizeHtml('', {
636 | allowedTags: ['script'],
637 | allowedAttributes: {
638 | script: ['src']
639 | },
640 | allowedScriptDomains: ['authorized.com'],
641 | })
642 | ```
643 |
644 | You can allow a script tag on a list of allowlisted hostnames too
645 |
646 | ```js
647 | const clean = sanitizeHtml('', {
648 | allowedTags: ['script'],
649 | allowedAttributes: {
650 | script: ['src']
651 | },
652 | allowedScriptHostnames: [ 'www.authorized.com' ],
653 | })
654 | ```
655 |
656 | ### Allowed URL schemes
657 |
658 | By default, we allow the following URL schemes in cases where `href`, `src`, etc. are allowed:
659 |
660 | ```js
661 | [ 'http', 'https', 'ftp', 'mailto' ]
662 | ```
663 |
664 | You can override this if you want to:
665 |
666 | ```js
667 | sanitizeHtml(
668 | // teeny-tiny valid transparent GIF in a data URL
669 | ' world
',
670 | {
671 | allowedTags: [ 'img', 'p' ],
672 | allowedSchemes: [ 'data', 'http' ]
673 | }
674 | );
675 | ```
676 |
677 | You can also allow a scheme for a particular tag only:
678 |
679 | ```js
680 | allowedSchemes: [ 'http', 'https' ],
681 | allowedSchemesByTag: {
682 | img: [ 'data' ]
683 | }
684 | ```
685 |
686 | And you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:
687 |
688 | ```js
689 | allowProtocolRelative: false
690 | ```
691 |
692 | ### Discarding the entire contents of a disallowed tag
693 |
694 | Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.
695 |
696 | The exceptions are:
697 |
698 | `style`, `script`, `textarea`, `option`
699 |
700 | If you wish to replace this list, for instance to discard whatever is found
701 | inside a `noscript` tag, use the `nonTextTags` option:
702 |
703 | ```js
704 | nonTextTags: [ 'style', 'script', 'textarea', 'option', 'noscript' ]
705 | ```
706 |
707 | Note that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.
708 |
709 | The content still gets escaped properly, with the exception of the `script` and
710 | `style` tags. *Allowing either `script` or `style` leaves you open to XSS
711 | attacks. Don't do that* unless you have good reason to trust their origin.
712 | sanitize-html will log a warning if these tags are allowed, which can be
713 | disabled with the `allowVulnerableTags: true` option.
714 |
715 | ### Choose what to do with disallowed tags
716 |
717 | Instead of discarding, or keeping text only, you may enable escaping of the entire content:
718 |
719 | ```js
720 | disallowedTagsMode: 'escape'
721 | ```
722 |
723 | This will transform `
foo
bar`) or explicit (e.g. `
foo
bar
`). 804 | 805 | For example, you may want to add spaces around a removed tag, like this: 806 | ```js 807 | const allowedTags = [ 'b' ]; 808 | let addSpace = false; 809 | const sanitizedHtml = sanitizeHtml( 810 | 'There should bespaces
after', {
11 | disallowedTagsMode: 'escape',
12 | allowedTags: [],
13 | allowedAttributes: false
14 | }), 'before <img src="test.png" /> after');
15 | });
16 | it('should handle numbers as strings', () => {
17 | assert.equal(sanitizeHtml(5, {
18 | allowedTags: [ 'b', 'em', 'i', 's', 'small', 'strong', 'sub', 'sup', 'time', 'u' ],
19 | allowedAttributes: {},
20 | disallowedTagsMode: 'recursiveEscape'
21 | }), '5');
22 | });
23 | it('should pass through simple, well-formed markup', function() {
24 | assert.equal(sanitizeHtml('Hello there
Hello there
Hello there
paragraph after closing html
', { 28 | enforceHtmlBoundary: true 29 | } 30 | ), 'Hello there
Hello there
paragraph after closing html
', { 34 | enforceHtmlBoundary: false 35 | } 36 | ), 'Text before html tagHello there
paragraph after closing html
'); 37 | }); 38 | it('should pass through text outside html tag boundary since option is ON but html tag is not found', function() { 39 | assert.equal(sanitizeHtml('Text before div tagHello there
paragraph after closing div
', { 40 | enforceHtmlBoundary: true 41 | } 42 | ), 'Text before div tagHello there
paragraph after closing div
'); 43 | }); 44 | it('should pass through all markup if allowedTags and allowedAttributes are set to false', function() { 45 | assert.equal(sanitizeHtml('Whee!
'), 'Blah blah blahWhee!
'); 72 | }); 73 | it('should return an empty string when input is explicit "undefined"', function() { 74 | assert.equal(sanitizeHtml(undefined), ''); 75 | }); 76 | it('should return an empty string when input is explicit "null"', function() { 77 | assert.equal(sanitizeHtml(null), ''); 78 | }); 79 | it('should return an empty string when input is not provided', function() { 80 | assert.equal(sanitizeHtml(), ''); 81 | }); 82 | it('should return an empty string when input is an empty string', function() { 83 | assert.equal(sanitizeHtml(''), ''); 84 | }); 85 | it('should reject markup not allowlisted without destroying its text', function() { 86 | assert.equal(sanitizeHtml('
Whee
Again
Wowcool', {
102 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ])
103 | }), '
Whee
Again
Wowcool
'); 104 | }); 105 | it('should reject hrefs that are not relative, ftp, http, https or mailto', function() { 106 | assert.equal(sanitizeHtml('googlehttps googleftpmailtorelativejavascript'), 'googlehttps googleftpmailtorelativejavascript'); 107 | }); 108 | it('should cope identically with capitalized attributes and tags and should tolerate capitalized schemes', function() { 109 | assert.equal(sanitizeHtml('googlehttps googleftpmailtorelativejavascript'), 'googlehttps googleftpmailtorelativejavascript'); 110 | }); 111 | it('should drop the content of script elements', function() { 112 | assert.equal(sanitizeHtml('Paragraph
'), 'Paragraph
'); 113 | }); 114 | it('should drop the content of style elements', function() { 115 | assert.equal(sanitizeHtml('Paragraph
'), 'Paragraph
'); 116 | }); 117 | it('should drop the content of textarea elements', function() { 118 | assert.equal(sanitizeHtml('Paragraph
'), 'Paragraph
'); 119 | }); 120 | it('should drop the content of option elements', function() { 121 | assert.equal(sanitizeHtml('Paragraph
'), 'Paragraph
'); 122 | }); 123 | it('should drop the content of textarea elements but keep the closing parent tag, when nested', function() { 124 | assert.equal(sanitizeHtml('Paragraph
'), 'Paragraph
'); 125 | }); 126 | it('should retain the content of fibble elements by default', function() { 127 | assert.equal(sanitizeHtml('Paragraph
'), 'NiftyParagraph
'); 128 | }); 129 | it('should discard the content of fibble elements if specified for nonTextTags', function() { 130 | assert.equal(sanitizeHtml('Paragraph
', { nonTextTags: [ 'fibble' ] }), 'Paragraph
'); 131 | }); 132 | it('should retain allowed tags within a fibble element if fibble is not specified for nonTextTags', function() { 133 | assert.equal(sanitizeHtml('Paragraph
', {}), 'NiftyParagraph
'); 134 | }); 135 | it('should discard allowed tags within a fibble element if fibble is specified for nonTextTags', function() { 136 | assert.equal(sanitizeHtml('Paragraph
', { nonTextTags: [ 'fibble' ] }), 'Paragraph
'); 137 | }); 138 | it('should preserve textarea content if textareas are allowed', function() { 139 | assert.equal(sanitizeHtml('Paragraph
', { 140 | allowedTags: [ 'textarea', 'p' ] 141 | }), 'Paragraph
'); 142 | }); 143 | it('should preserve entities as such', function() { 144 | assert.equal(sanitizeHtml('<Kapow!>'), '<Kapow!>'); 145 | }); 146 | it('should dump closing tags which do not have any opening tags.', function() { 147 | assert.equal(sanitizeHtml('inner text 1
inner text 2
inner text 3
inner text 1
inner text 2
inner text 3
inner text 1
inner text 2
inner text 3
Whee
'), 'Whee
'); 165 | }); 166 | it('should dump a sneaky encoded javascript url', function() { 167 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 168 | }); 169 | it('should dump an uppercase javascript url', function() { 170 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 171 | }); 172 | it('should dump a javascript URL with a comment in the middle (probably only respected by browsers in XML data islands, but just in case someone enables those)', function() { 173 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 174 | }); 175 | it('should not mess up a hashcode with a : in it', function() { 176 | assert.equal(sanitizeHtml('Hi'), 'Hi'); 177 | }); 178 | it('should dump character codes 1-32 before testing scheme', function() { 179 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 180 | }); 181 | it('should dump character codes 1-32 even when escaped with padding rather than trailing ;', function() { 182 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 183 | // This one is weird, but the browser does not interpret it 184 | // as a scheme, so we're OK. That character is 65535, not null. I 185 | // think it's a limitation of the entities module 186 | assert.equal(sanitizeHtml('Hax'), 'Hax'); 187 | }); 188 | it('should still like nice schemes', function() { 189 | assert.equal(sanitizeHtml('Hi'), 'Hi'); 190 | }); 191 | it('should still like nice relative URLs', function() { 192 | assert.equal(sanitizeHtml('Hi'), 'Hi'); 193 | }); 194 | it('should replace ol to ul', function() { 195 | assert.equal(sanitizeHtml('text before
text after
text before text after
'); 286 | }); 287 | 288 | it('should add new text when not initially set and replace attributes when they are changed by transforming function', function () { 289 | assert.equal(sanitizeHtml('', { 290 | transformTags: { 291 | a: function (tagName, attribs) { 292 | return { 293 | tagName: tagName, 294 | attribs: attribs, 295 | text: 'some new text' 296 | }; 297 | } 298 | } 299 | }), 'some new text'); 300 | }); 301 | 302 | it('should preserve text when initially set and replace attributes when they are changed by transforming function', function () { 303 | assert.equal(sanitizeHtml('some initial text', { 304 | transformTags: { 305 | a: function (tagName, attribs) { 306 | return { 307 | tagName: tagName, 308 | attribs: attribs 309 | }; 310 | } 311 | } 312 | }), 'some initial text'); 313 | }); 314 | 315 | it('should skip an empty link', function() { 316 | assert.strictEqual( 317 | sanitizeHtml('', { 318 | exclusiveFilter: function (frame) { 319 | return frame.tag === 'a' && !frame.text.trim(); 320 | } 321 | }), 322 | 'This is
Linux
12
3
124
' 344 | ); 345 | }); 346 | 347 | it('Should collapse nested empty elements', function() { 348 | assert.strictEqual( 349 | sanitizeHtml('', { 350 | exclusiveFilter: function(frame) { 351 | return (frame.tag === 'a' || frame.tag === 'p') && !frame.text.trim(); 352 | } 353 | }), 354 | '' 355 | ); 356 | }); 357 | 358 | it('Should find child media elements that are in allowedTags', function() { 359 | const markup = 'These links hack more hack have disallowed href protocols
', { 403 | exclusiveFilter: function (frame) { 404 | return frame.tag === 'a' && !frame.attribs.src ? 'excludeTag' : false; 405 | } 406 | }), 407 | 'These links hack more hack have disallowed href protocols
' 408 | ); 409 | }); 410 | 411 | it('should keep inner tags when exclusiveFilter returns "excludeTag"', function() { 412 | assert.strictEqual( 413 | sanitizeHtml('This div is badshould be kept as-is
should be kept as-is
.' 419 | ); 420 | }); 421 | 422 | it('should work with escaped tags when exclusiveFilter returns "excludeTag"', function () { 423 | assert.strictEqual( 424 | sanitizeHtml('hello',
439 | {
440 | allowedTags: [ 'img' ]
441 | }
442 | ),
443 | '',
451 | {
452 | allowedTags: [ 'img', 'p' ],
453 | allowedSchemes: [ 'data', 'http' ]
454 | }
455 | ),
456 | ''
457 | );
458 | });
459 | it('should allow specific classes when allowlisted with allowedClasses for a single tag', function() {
460 | assert.equal(
461 | sanitizeHtml(
462 | 'whee
', 463 | { 464 | allowedTags: [ 'p' ], 465 | allowedClasses: { 466 | p: [ 'nifty' ] 467 | } 468 | } 469 | ), 470 | 'whee
' 471 | ); 472 | }); 473 | it('should allow specific classes when allowlisted with allowedClasses for all tags', function() { 474 | assert.equal( 475 | sanitizeHtml( 476 | 'whee
', 477 | { 478 | allowedTags: [ 'p', 'div' ], 479 | allowedClasses: { 480 | '*': [ 'nifty' ] 481 | } 482 | } 483 | ), 484 | 'whee
' 485 | ); 486 | }); 487 | it('should allow all classes that are allowlisted for a single tag or all tags', function() { 488 | assert.equal( 489 | sanitizeHtml( 490 | 'whee
', 491 | { 492 | allowedTags: [ 'p', 'div' ], 493 | allowedClasses: { 494 | '*': [ 'simple' ], 495 | p: [ 'nifty' ], 496 | div: [ 'dippy' ] 497 | } 498 | } 499 | ), 500 | 'whee
' 501 | ); 502 | }); 503 | it('should allow classes that match wildcards for a single tag or all tags', function() { 504 | assert.equal( 505 | sanitizeHtml( 506 | 'whee
', 507 | { 508 | allowedTags: [ 'p' ], 509 | allowedClasses: { 510 | '*': [ 'dippy-*-simple' ], 511 | p: [ 'nifty-*' ] 512 | } 513 | } 514 | ), 515 | 'whee
' 516 | ); 517 | }); 518 | it('should allow all classes if `allowedClasses` contains a single `*`', function() { 519 | assert.equal( 520 | sanitizeHtml( 521 | 'whee
', 522 | { 523 | allowedTags: [ 'p' ], 524 | allowedClasses: { 525 | '*': [ '*' ] 526 | } 527 | } 528 | ), 529 | 'whee
' 530 | ); 531 | }); 532 | it('should allow all classes for a single tag if `allowedClasses` for the tag is false', function() { 533 | assert.equal( 534 | sanitizeHtml( 535 | 'whee
', 536 | { 537 | allowedTags: [ 'p' ], 538 | allowedClasses: { 539 | p: false 540 | } 541 | } 542 | ), 543 | 'whee
' 544 | ); 545 | }); 546 | it('should allow only classes that matches `allowedClasses` regex', function() { 547 | assert.equal( 548 | sanitizeHtml( 549 | 'whee
', 550 | { 551 | allowedTags: [ 'p' ], 552 | allowedClasses: { 553 | p: [ /^nifty\d{2}$/, /^d\w{4}$/ ] 554 | } 555 | } 556 | ), 557 | 'whee
' 558 | ); 559 | }); 560 | it('should allow classes that match `allowedClasses` regex for all tags', function() { 561 | assert.equal( 562 | sanitizeHtml( 563 | 'whee
', 564 | { 565 | allowedClasses: { 566 | '*': [ /^nifty\d{2}$/, /^d\w{4}$/ ] 567 | } 568 | } 569 | ), 570 | 'whee
' 571 | ); 572 | }); 573 | it('should allow defining schemes on a per-tag basis', function() { 574 | assert.equal( 575 | sanitizeHtml( 576 | // teeny-tiny valid transparent GIF in a data URL 577 | '',
578 | {
579 | allowedTags: [ 'img', 'a' ],
580 | allowedSchemes: [ 'http' ],
581 | allowedSchemesByTag: {
582 | img: [ 'data' ],
583 | a: [ 'https' ]
584 | }
585 | }
586 | ),
587 | ''
588 | );
589 | assert.equal(
590 | sanitizeHtml(
591 | // teeny-tiny valid transparent GIF in a data URL
592 | '',
593 | {
594 | allowedTags: [ 'img', 'a' ],
595 | allowedSchemes: [ 'http' ],
596 | allowedSchemesByTag: {
597 | img: [],
598 | a: [ 'https' ]
599 | }
600 | }
601 | ),
602 | 'whee
', 609 | { 610 | allowedTags: [ 'p' ], 611 | allowedClasses: { 612 | p: [ 'nifty' ] 613 | } 614 | } 615 | ), 616 | 'whee
' 617 | ); 618 | }); 619 | it('should not crash on bad markup', function() { 620 | assert.equal( 621 | sanitizeHtml( 622 | '',
631 | {
632 | allowedTags: [ 'img' ],
633 | allowedAttributes: {
634 | img: [ 'src' ]
635 | }
636 | }
637 | ),
638 | // This is weird but not dangerous. Without the " there
639 | // would probably be some way to make it come out as a
640 | // separate attribute
641 | ''
642 | );
643 | });
644 |
645 | it('should deliver a warning if using vulnerable tags', function() {
646 | const spy = sinon.spy(console, 'warn');
647 | const message = '\n\n⚠️ Your `allowedTags` option includes, `style`, which is inherently\nvulnerable to XSS attacks. Please remove it from `allowedTags`.\nOr, to disable this warning, add the `allowVulnerableTags` option\nand ensure you are accounting for this risk.\n\n';
648 |
649 | sanitizeHtml(
650 | '',
651 | {
652 | allowedTags: [ 'style' ]
653 | }
654 | );
655 |
656 | assert(spy.calledWith(message));
657 | // Restore the spied-upon method
658 | console.warn.restore();
659 | });
660 |
661 | it('should not deliver a warning if using the allowVulnerableTags option', function() {
662 | const spy = sinon.spy(console, 'warn');
663 |
664 | sanitizeHtml(
665 | '',
666 | {
667 | allowVulnerableTags: true,
668 | allowedTags: [ 'style' ]
669 | }
670 | );
671 |
672 | assert(spy.notCalled);
673 | // Restore the spied-upon method
674 | console.warn.restore();
675 | });
676 |
677 | it('should allow only approved attributes, but to any tags, if tag is declared as "*"', function() {
678 | assert.equal(
679 | sanitizeHtml(
680 | '
Text
', 753 | { 754 | allowedTags: [ 'p' ], 755 | allowedAttributes: { p: [ 'style' ] }, 756 | transformTags: { 757 | '*': function (tagName, attribs) { 758 | return { 759 | tagName: tagName, 760 | attribs: { 761 | style: 'text-align: center' 762 | } 763 | }; 764 | } 765 | } 766 | } 767 | ), 768 | 'Text
' 769 | ); 770 | }); 771 | it('should not be faked out by double <', function() { 772 | assert.equal( 773 | sanitizeHtml('<
', {
912 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ])
913 | }),
914 | ''
915 | );
916 | });
917 | it('should accept srcset if allowed', function() {
918 | assert.equal(
919 | sanitizeHtml('', {
920 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ]),
921 | allowedAttributes: { img: [ 'src', 'srcset' ] }
922 | }),
923 | ''
924 | );
925 | assert.equal(
926 | sanitizeHtml('', {
927 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ]),
928 | allowedAttributes: { img: [ 'src', 'srcset' ] }
929 | }),
930 | ''
931 | );
932 | });
933 | it('should drop bogus srcset', function() {
934 | assert.equal(
935 | sanitizeHtml('', {
936 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ]),
937 | allowedAttributes: { img: [ 'src', 'srcset' ] }
938 | }),
939 | ''
940 | );
941 | });
942 | it('should accept srcset with urls containing commas', function() {
943 | assert.equal(
944 | sanitizeHtml('', {
945 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ]),
946 | allowedAttributes: { img: [ 'src', 'srcset' ] }
947 | }),
948 | ''
949 | );
950 | });
951 |
952 | it('text from transformTags should not specify tags', function() {
953 | const input = '';
954 | const want = '<script>alert(1)</script>';
955 | // Runs the sanitizer with a policy that turns an attribute into
956 | // text. A policy like this might be used to turn inputs into
957 | // inline elements that look like the original but which do not
958 | // affect form submissions.
959 | const got = sanitizeHtml(
960 | input,
961 | {
962 | allowedTags: [ 'u' ],
963 | allowedAttributes: { '*': [ 'class' ] },
964 | transformTags: {
965 | input: function (tagName, attribs) {
966 | return {
967 | tagName: 'u',
968 | attribs: { class: 'inlined-input' },
969 | text: attribs.value
970 | };
971 | }
972 | }
973 | });
974 | assert.equal(got, want);
975 | });
976 | it('drop attribute names with meta-characters', function() {
977 | assert.equal(
978 | sanitizeHtml('alert(1)//>', {
979 | allowedTags: [ 'span' ],
980 | allowedAttributes: { span: [ 'data-*' ] }
981 | }),
982 | 'alert(1)//>'
983 | );
984 | });
985 | it('should sanitize styles correctly', function() {
986 | const sanitizeString = 'bestetestestestestestsettestestest
'; 987 | const expected = '
- test
- test
- test
- test
test
TESTETESTESTES
bestetestestestestestsettestestest
'; 988 | assert.equal( 989 | sanitizeHtml(sanitizeString, { 990 | allowedTags: false, 991 | allowedAttributes: { 992 | '*': [ 'dir' ], 993 | p: [ 'dir', 'style' ], 994 | li: [ 'style' ], 995 | span: [ 'style' ] 996 | }, 997 | allowedStyles: { 998 | '*': { 999 | // Matches hex 1000 | color: [ /#(0x)?[0-9a-f]+/i ], 1001 | 'text-align': [ /left/, /right/, /center/, /justify/, /initial/, /inherit/ ], 1002 | 'font-size': [ /36px/ ] 1003 | } 1004 | } 1005 | }).replace(/ /g, ''), expected.replace(/ /g, '') 1006 | ); 1007 | }); 1008 | it('Should remove empty style tags', function() { 1009 | assert.equal( 1010 | sanitizeHtml('', { 1011 | allowedTags: false, 1012 | allowedAttributes: false 1013 | }), 1014 | '' 1015 | ); 1016 | }); 1017 | it('Should remove invalid styles', function() { 1018 | assert.equal( 1019 | sanitizeHtml('', { 1020 | allowedTags: false, 1021 | allowedAttributes: { 1022 | span: [ 'style' ] 1023 | }, 1024 | allowedStyles: { 1025 | span: { 1026 | color: [ /blue/ ], 1027 | 'text-align': [ /left/ ] 1028 | } 1029 | } 1030 | }), '' 1031 | ); 1032 | }); 1033 | it('Should ignore styles when options.parseStyleAttributes is false', function() { 1034 | assert.equal( 1035 | sanitizeHtml('', { 1036 | allowedTags: false, 1037 | allowedAttributes: { 1038 | span: [ 'style' ] 1039 | }, 1040 | parseStyleAttributes: false 1041 | }), '' 1042 | ); 1043 | }); 1044 | it('Should throw an error if both allowedStyles is set and && parseStyleAttributes is set to false', function() { 1045 | try { 1046 | sanitizeHtml('', { 1047 | allowedTags: false, 1048 | allowedAttributes: { 1049 | span: [ 'style' ] 1050 | }, 1051 | allowedStyles: { 1052 | p: { 1053 | 'text-align': [ /^justify$/ ] 1054 | } 1055 | }, 1056 | parseStyleAttributes: false 1057 | }); 1058 | assert(false); 1059 | } catch (err) { 1060 | assert.equal(err.message, 'allowedStyles option cannot be used together with parseStyleAttributes: false.'); 1061 | } 1062 | }); 1063 | it('Should support !important styles', function() { 1064 | assert.equal( 1065 | sanitizeHtml('', { 1066 | allowedTags: false, 1067 | allowedAttributes: { 1068 | span: [ 'style' ] 1069 | }, 1070 | allowedStyles: { 1071 | span: { 1072 | color: [ /blue/ ] 1073 | } 1074 | } 1075 | }), '' 1076 | ); 1077 | }); 1078 | it('Should allow a specific style from global', function() { 1079 | assert.equal( 1080 | sanitizeHtml('', { 1081 | allowedTags: false, 1082 | allowedAttributes: { 1083 | span: [ 'style' ] 1084 | }, 1085 | allowedStyles: { 1086 | '*': { 1087 | color: [ /yellow/ ], 1088 | 'text-align': [ /center/ ] 1089 | }, 1090 | span: { 1091 | color: [ /green/ ], 1092 | 'font-family': [ /helvetica/ ] 1093 | } 1094 | } 1095 | }), '' 1096 | ); 1097 | }); 1098 | it('should delete the script tag', function() { 1099 | assert.equal(sanitizeHtml('', { 1100 | allowedTags: [ 'script' ], 1101 | allowVulnerableTags: true, 1102 | allowedAttributes: { 1103 | script: [ 'src' ] 1104 | }, 1105 | allowedScriptHostnames: [ 'www.authorized.com' ] 1106 | }), ''); 1107 | }); 1108 | it('should delete the script tag since src is not a valid URL', function() { 1109 | assert.equal(sanitizeHtml('', { 1110 | allowedTags: [ 'script' ], 1111 | allowVulnerableTags: true, 1112 | allowedAttributes: { 1113 | script: [ 'src' ] 1114 | }, 1115 | allowedScriptHostnames: [ 'www.unauthorized.com' ] 1116 | }), ''); 1117 | }); 1118 | it('Should allow domains in a script that are in allowedScriptDomains', function() { 1119 | assert.equal( 1120 | sanitizeHtml('', { 1121 | allowedTags: [ 'script' ], 1122 | allowedAttributes: { 1123 | script: [ 'src' ] 1124 | }, 1125 | allowedScriptDomains: [ 'authorized.com' ] 1126 | }), '' 1127 | ); 1128 | }); 1129 | it('should delete the script tag content', function() { 1130 | assert.equal(sanitizeHtml('', { 1131 | allowedTags: [ 'script' ], 1132 | allowVulnerableTags: true, 1133 | allowedAttributes: { 1134 | script: [ 'src' ] 1135 | }, 1136 | allowedScriptHostnames: [ 'www.authorized.com' ] 1137 | }), ''); 1138 | }); 1139 | it('should delete the script tag content from script tags with no src when allowedScriptHostnames is present', function() { 1140 | assert.equal(sanitizeHtml('', { 1141 | allowedTags: [ 'script' ], 1142 | allowVulnerableTags: true, 1143 | allowedAttributes: { 1144 | script: [ 'src' ] 1145 | }, 1146 | allowedScriptHostnames: [ 'www.authorized.com' ] 1147 | }), ''); 1148 | }); 1149 | it('should delete the script tag content from script tags with no src when allowedScriptDomains is present', function() { 1150 | assert.equal(sanitizeHtml('', { 1151 | allowedTags: [ 'script' ], 1152 | allowVulnerableTags: true, 1153 | allowedAttributes: { 1154 | script: [ 'src' ] 1155 | }, 1156 | allowedScriptDomains: [ 'www.authorized.com' ] 1157 | }), ''); 1158 | }); 1159 | it('Should allow hostnames in a script that are in allowedScriptHostnames', function() { 1160 | assert.equal(sanitizeHtml('', { 1161 | allowedTags: [ 'script' ], 1162 | allowVulnerableTags: true, 1163 | allowedAttributes: { 1164 | script: [ 'src' ] 1165 | }, 1166 | allowedScriptHostnames: [ 'www.authorized.com' ] 1167 | }), ''); 1168 | }); 1169 | it('Should allow hostnames in an iframe that are in allowedIframeHostnames', function() { 1170 | assert.equal( 1171 | sanitizeHtml('', { 1172 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1173 | allowedAttributes: { 1174 | iframe: [ 'src', 'href' ], 1175 | a: [ 'src', 'href' ], 1176 | img: [ 'src' ] 1177 | }, 1178 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ] 1179 | }), '' 1180 | ); 1181 | }); 1182 | it('Should remove iframe src urls that are not included in allowedIframeHostnames', function() { 1183 | assert.equal( 1184 | sanitizeHtml('', { 1185 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1186 | allowedAttributes: { 1187 | iframe: [ 'src', 'href' ], 1188 | a: [ 'src', 'href' ], 1189 | img: [ 'src' ] 1190 | }, 1191 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ] 1192 | }), '' 1193 | ); 1194 | }); 1195 | it('Should not allow iframe urls that do not have proper hostname', function() { 1196 | assert.equal( 1197 | sanitizeHtml('', { 1198 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1199 | allowedAttributes: { 1200 | iframe: [ 'src', 'href' ], 1201 | a: [ 'src', 'href' ], 1202 | img: [ 'src' ] 1203 | }, 1204 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ] 1205 | }), '' 1206 | ); 1207 | }); 1208 | it('Should allow iframe through if no hostname option is set', function() { 1209 | assert.equal( 1210 | sanitizeHtml('', { 1211 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1212 | allowedAttributes: { 1213 | iframe: [ 'src', 'href' ], 1214 | a: [ 'src', 'href' ], 1215 | img: [ 'src' ] 1216 | } 1217 | }), '' 1218 | ); 1219 | }); 1220 | it('Should allow domains in an iframe that are in allowedIframeDomains', function() { 1221 | assert.equal( 1222 | sanitizeHtml('', { 1223 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1224 | allowedAttributes: { 1225 | iframe: [ 'src', 'href' ], 1226 | a: [ 'src', 'href' ], 1227 | img: [ 'src' ] 1228 | }, 1229 | allowedIframeDomains: [ 'zoom.us' ] 1230 | }), '' 1231 | ); 1232 | }); 1233 | it('Should allow second-level domains in an iframe that are in allowedIframeDomains', function() { 1234 | assert.equal( 1235 | sanitizeHtml('', { 1236 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1237 | allowedAttributes: { 1238 | iframe: [ 'src', 'href' ], 1239 | a: [ 'src', 'href' ], 1240 | img: [ 'src' ] 1241 | }, 1242 | allowedIframeDomains: [ 'zoom.us' ] 1243 | }), '' 1244 | ); 1245 | }); 1246 | it('Should remove iframe src urls that are not included in allowedIframeDomains', function() { 1247 | assert.equal( 1248 | sanitizeHtml('', { 1249 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1250 | allowedAttributes: { 1251 | iframe: [ 'src', 'href' ], 1252 | a: [ 'src', 'href' ], 1253 | img: [ 'src' ] 1254 | }, 1255 | allowedIframeDomains: [ 'vimeo.com' ] 1256 | }), '' 1257 | ); 1258 | }); 1259 | it('Should remove iframe src urls with host that ends as allowed domains but not preceded with a dot', function() { 1260 | assert.equal( 1261 | sanitizeHtml('', { 1262 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1263 | allowedAttributes: { 1264 | iframe: [ 'src', 'href' ], 1265 | a: [ 'src', 'href' ], 1266 | img: [ 'src' ] 1267 | }, 1268 | allowedIframeDomains: [ 'zoom.us' ] 1269 | }), '' 1270 | ); 1271 | }); 1272 | it('Should allow hostnames in an iframe that are in allowedIframeHostnames and are not in allowedIframeDomains', function() { 1273 | assert.equal( 1274 | sanitizeHtml('', { 1275 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1276 | allowedAttributes: { 1277 | iframe: [ 'src', 'href' ], 1278 | a: [ 'src', 'href' ], 1279 | img: [ 'src' ] 1280 | }, 1281 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ], 1282 | allowedIframeDomains: [ 'zoom.us' ] 1283 | }), '' 1284 | ); 1285 | }); 1286 | it('Should allow hostnames in an iframe that are not in allowedIframeHostnames ' + 1287 | 'and are allowlisted in allowedIframeDomains', function() { 1288 | assert.equal( 1289 | sanitizeHtml('', { 1290 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1291 | allowedAttributes: { 1292 | iframe: [ 'src', 'href' ], 1293 | a: [ 'src', 'href' ], 1294 | img: [ 'src' ] 1295 | }, 1296 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ], 1297 | allowedIframeDomains: [ 'zoom.us' ] 1298 | }), '' 1299 | ); 1300 | }); 1301 | it('Should allow relative URLs for iframes by default', function() { 1302 | assert.equal( 1303 | sanitizeHtml('', { 1304 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1305 | allowedAttributes: { 1306 | iframe: [ 'src', 'href' ], 1307 | a: [ 'src', 'href' ], 1308 | img: [ 'src' ] 1309 | } 1310 | }), '' 1311 | ); 1312 | }); 1313 | it('Should allow relative URLs for iframes', function() { 1314 | assert.equal( 1315 | sanitizeHtml('', { 1316 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1317 | allowedAttributes: { 1318 | iframe: [ 'src', 'href' ], 1319 | a: [ 'src', 'href' ], 1320 | img: [ 'src' ] 1321 | }, 1322 | allowIframeRelativeUrls: true 1323 | }), '' 1324 | ); 1325 | }); 1326 | it('Should remove relative URLs for iframes', function() { 1327 | assert.equal( 1328 | sanitizeHtml('', { 1329 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1330 | allowedAttributes: { 1331 | iframe: [ 'src', 'href' ], 1332 | a: [ 'src', 'href' ], 1333 | img: [ 'src' ] 1334 | }, 1335 | allowIframeRelativeUrls: false 1336 | }), '' 1337 | ); 1338 | }); 1339 | it('Should remove relative URLs for iframes when other hostnames are specified in allowedIframeHostnames', function() { 1340 | assert.equal( 1341 | sanitizeHtml('', { 1342 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1343 | allowedAttributes: { 1344 | iframe: [ 'src', 'href' ], 1345 | a: [ 'src', 'href' ], 1346 | img: [ 'src' ] 1347 | }, 1348 | allowedIframeHostnames: [ 'www.youtube.com' ] 1349 | }), '' 1350 | ); 1351 | }); 1352 | it('Should allow relative and allowlisted hostname URLs for iframes', function() { 1353 | assert.equal( 1354 | sanitizeHtml('', { 1355 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1356 | allowedAttributes: { 1357 | iframe: [ 'src', 'href' ], 1358 | a: [ 'src', 'href' ], 1359 | img: [ 'src' ] 1360 | }, 1361 | allowIframeRelativeUrls: true, 1362 | allowedIframeHostnames: [ 'www.youtube.com' ] 1363 | }), '' 1364 | ); 1365 | }); 1366 | it('Should allow protocol-relative URLs for the right domain for iframes', function() { 1367 | assert.equal( 1368 | sanitizeHtml('', { 1369 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1370 | allowedAttributes: { 1371 | iframe: [ 'src', 'href' ], 1372 | a: [ 'src', 'href' ], 1373 | img: [ 'src' ] 1374 | }, 1375 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ] 1376 | }), '' 1377 | ); 1378 | }); 1379 | it('Should not allow protocol-relative iframe urls that do not have proper hostname', function() { 1380 | assert.equal( 1381 | sanitizeHtml('', { 1382 | allowedTags: [ 'p', 'iframe', 'a', 'img', 'i' ], 1383 | allowedAttributes: { 1384 | iframe: [ 'src', 'href' ], 1385 | a: [ 'src', 'href' ], 1386 | img: [ 'src' ] 1387 | }, 1388 | allowedIframeHostnames: [ 'www.youtube.com', 'player.vimeo.com' ] 1389 | }), '' 1390 | ); 1391 | }); 1392 | it('Should only allow attributes to have any combination of specific values', function() { 1393 | assert.equal( 1394 | sanitizeHtml('', { 1395 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'iframe' ]), 1396 | allowedAttributes: { 1397 | iframe: [ 1398 | { 1399 | name: 'sandbox', 1400 | multiple: true, 1401 | values: [ 'allow-popups', 'allow-same-origin', 'allow-scripts' ] 1402 | }, 1403 | 'allowfullscreen' 1404 | ] 1405 | } 1406 | }), ''); 1407 | }); 1408 | it('Should only allow attributes that match a specific value', function() { 1409 | assert.equal( 1410 | sanitizeHtml('', { 1411 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'iframe' ]), 1412 | allowedAttributes: { 1413 | iframe: [ 1414 | { 1415 | name: 'sandbox', 1416 | multiple: false, 1417 | values: [ 'allow-popups', 'allow-same-origin', 'allow-scripts' ] 1418 | } 1419 | ] 1420 | } 1421 | }), ''); 1422 | } 1423 | ); 1424 | it('Should not allow cite urls that do not have an allowed scheme', function() { 1425 | assert.equal( 1426 | sanitizeHtml('
- test
- test
- test
- test
test
TESTETESTESTES
HTTP
HTTPS
MAILTO
TEL
ms-calculator
FTP
DATA
LDAP
ACROBAT
VBSCRIPT
FILE
RLOGIN
WEBCAL
JAVASCRIPT
MMS', { 1427 | allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'q' ]), 1428 | allowedAttributes: { q: [ 'cite' ] }, 1429 | allowedSchemes: sanitizeHtml.defaults.allowedSchemes.concat([ 'tel' ]) 1430 | }), '
HTTP
HTTPS
MAILTO
TEL
ms-calculator
FTP
DATA
LDAP
ACROBAT
VBSCRIPT
FILE
RLOGIN
WEBCAL
JAVASCRIPT
MMS'); 1431 | }); 1432 | it('Should encode &, <, > and where necessary, "', function() { 1433 | assert.equal(sanitizeHtml('"< & >" cool', { 1434 | allowedTags: [ 'span' ], 1435 | allowedAttributes: { 1436 | span: [ 'class' ] 1437 | } 1438 | }), '"< & >" cool'); 1439 | }); 1440 | it('Should not pass through &0; unescaped if decodeEntities is true (the default)', function() { 1441 | assert.equal(sanitizeHtml('
World
World
World
</wiggly>World
World
World
<tiggly>JS</tiggly></wiggly>Allowed content
More allowed content Another TextAllowed content
More allowed content'; 1733 | const sanitizedHtml = sanitizeHtml(inputHtml, { 1734 | allowedTags: [ 'p', 'span' ], 1735 | disallowedTagsMode: 'completelyDiscard' 1736 | }); 1737 | assert.equal(sanitizedHtml, expectedOutput); 1738 | }); 1739 | it('should remove top level tag\'s content', () => { 1740 | const inputHtml = 'Some Textparagraph content
content'; 1741 | const expectedOutput = 'paragraph content
'; 1742 | const sanitizedHtml = sanitizeHtml(inputHtml, { 1743 | allowedTags: [ 'p' ], 1744 | disallowedTagsMode: 'completelyDiscard' 1745 | }); 1746 | assert.equal(sanitizedHtml, expectedOutput); 1747 | }); 1748 | it('should completely remove disallowed tag with unclosed tag', () => { 1749 | const inputHtml = 'paragraph content
some text'; 1750 | const expectedOutput = 'paragraph content
'; 1751 | const sanitizedHtml = sanitizeHtml(inputHtml, { 1752 | allowedTags: [ 'p' ], 1753 | disallowedTagsMode: 'completelyDiscard' 1754 | }); 1755 | 1756 | assert.equal(sanitizedHtml, expectedOutput); 1757 | }); 1758 | it('should transform text content of tags even if they originally had none', () => { 1759 | const inputHtml = ''; 1760 | const expectedOutput = 'new content'; 1761 | const sanitizedHtml = sanitizeHtml(inputHtml, { 1762 | allowedTags: [], 1763 | transformTags: { 1764 | div: () => ({ text: 'new content' }) 1765 | } 1766 | }); 1767 | 1768 | assert.equal(sanitizedHtml, expectedOutput); 1769 | }); 1770 | it('should call onOpenTag and onCloseTag callbacks', () => { 1771 | const onOpenTag = sinon.spy(); 1772 | const onCloseTag = sinon.spy(); 1773 | const inputHtml = 'paragraph content
some text
it's there
