Neatly Prepared Mustache

    html-janitor

    2.0.4 • Public • Published

    html-janitor

    Cleans up your markup and allows you to take control of your HTML.

    HTMLJanitor uses a defined whitelist to limit HTML it is given to a defined subset.

    XSS Note

    This library has not been extensively tested. In particular versions prior to 2.0.3 are vulnerable to XSS attacks. See here and here.

    Please upgrade to 2.0.4 or above and consider building your own additional checks on user input.

    Usage

    var janitor = new HTMLJanitor(options);
    
    var sanitisedHtml = janitor.clean(html);
    
    

    Options

    A configuration object.

    tags defines a whitelist of elements that are allowed in the sanitised output. Each entry in the map should be the name of the element and the attributes that a valid for the element.

    E.g. {tags: { p:{}, a: { href: true} }} would limit the valid HTML subset to just paragraphs and anchor tags. Paragraph tags would have all attributes stripped, and the anchor tags would only have the href attribute preserved.

    Blacklisting and whitelisting all attributes

    You can set an element to be true to allow all attributes on an element and false to remove all attributes.

    Using logic

    If you need to apply logic when determining whether to whitelist an element or an attribute, you can pass a function.

    Here's an example that removes all <u> elements that are empty.

        u: function(el){
          // Remove empty underline tags.
          var shouldKeep = el.textContent !== '';
          return shouldKeep;
        },
    

    A function can also be used for attributes, only the attribute's value and the element are passed as the function arguments:

         img: {
          height: function(value){
            // Only allow if height is less than 10.
            return parseInt(value) < 10;
          },
          width: function(value, el){
            // Only allow if height also specified.
            return el.hasAttribute('height');
          }
        }
    

    Functions may return any value that's accepted as a regular value, including an object:

         blockquote: function(el) {
          if (el.classList.contains('indent')){
            return { 'class': true, 'style': true }; // If blockquote has class 'indent', also allow style.
          } else {
            return {}; // Strip everything
          }
        }
    
    

    Distribution

    Uses UMD for support in AMD and Common JS environments.

    Not suitable for Node

    This library is designed for use in a browser and requires access to document and createTreeWalker to work.

    Installation

    npm install html-janitor
    

    Development

    To run unit tests:

    npm install
    npm run test
    

    Keywords

    none

    Install

    npm i html-janitor

    DownloadsWeekly Downloads

    1,628

    Version

    2.0.4

    License

    none

    Unpacked Size

    30 kB

    Total Files

    7

    Last publish

    Collaborators

    • oliverjash
    • scribe-dev