html-sanitizer-p5
html-sanitizer-p5
is a simple HTML sanitizer built on parse5.
html-sanitizer-p5
allows you to specify HTML tags and attributes that you want to keep. If a tag or attribute is not allowed, it is deleted. Tag contents are preserved subject to options.
href
attributes are validated to ensure they only contain http
, https
, ftp
and mailto
URLs. Relative URLs are also allowed. You can also limit src domains for iframes.
HTML comments are preserved by default. You can change this behavior by setting the option keepComments
to false
.
Requirements
html-sanitizer-p5
is a pure Javascript module with only one dependency on parse5
.
Install
npm install html-sanitizer-p5
Usage
var sanitizer = ; /* Santize HTML fragments typically submitted by WYSIWYG editors like tinyMCE */var html = '<div class="p-1"><script src="http://malicious.org"></script></div>';var clean = sanitizer;
That will allow the default list of allowed tags and attributes. You can override default behavior as follows:
// Allow only a restricted set of tags and attributesclean = sanitizer;
Options
- allowedTags - Array of tag names. Specify
false
to allow everything and[]
to allow nothing. - allowedAttributes - Object that specifies allowed attributes for one more tags. Use '*' to specify attributes that are allowed on any element. For example:
'*': 'class' 'style' 'img': 'src'
- allowedIframeDomains - Array of domains that can appear as iframe source
- allowedUrlSchemes - Array of URL schemes that are allowed in href attribute of links
- keepComments - Specify
false
to remove comments
Defaults
Default option values are available via properties of the sanitizer object with the same name. For example sanitizer.allowedTags
returns default array of allowed tags.
allowedTags: 'h1' 'h2' 'h3' 'h4' 'h5' 'h6' 'blockquote' 'p' 'a' 'ul' 'ol' 'nl' 'li' 'b' 'i' 'strong' 'em' 'strike' 'code' 'hr' 'br' 'div' 'table' 'thead' 'caption' 'tbody' 'tr' 'th' 'td' 'pre' 'span' 'img' 'iframe' allowedAttributes: '*': 'class' 'style' a: 'href' 'name' 'target' img: 'src' iframe: 'src' allowedIframeDomains: 'www.youtube.com' 'player.vimeo.com' allowedUrlSchemes: 'http' 'https' 'ftp' 'mailto'