Skip to content
This repository was archived by the owner on Feb 26, 2026. It is now read-only.

Bug Fix: allow false in allowedClasses#623

Merged
boutell merged 3 commits intoapostrophecms:mainfrom
KevinSJ:main
Jun 13, 2023
Merged

Bug Fix: allow false in allowedClasses#623
boutell merged 3 commits intoapostrophecms:mainfrom
KevinSJ:main

Conversation

@KevinSJ
Copy link
Copy Markdown
Contributor

@KevinSJ KevinSJ commented May 26, 2023

Summary

Prior to 2.4.0, allowedClasses can be false, this has been an undocumented feature.
Since 2.4.0, this behavior is broken. This PR reverted to the previous behavior where false is allowed in the allowedClasses attribute.

See #621 for more detail

What are the specific steps to test this change?

The following code is broken in the main branch of this base repo, but should work in the branch in this pr.

const sanitizeHtml = require('sanitize-html');

const ALLOWED_TAGS = [
    'li',
    'ul',
    'ol',
    'p',
    'h1',
    'h2',
    'h3',
    'h4',
    'h5',
    'h6',
    'img',
    'a',
    'div',
    'b',
    'table',
    'tbody',
    'tr',
    'th',
    'td'
];
const ALLOWED_SCHEMES = ['https', 'mailto'];

const sanitized = sanitizeHtml(`<ul class="should not sanitize"><li>Hello </li></ul>`, {
    allowedAttributes: { '*': ['*'] },
    allowedTags: ALLOWED_TAGS,
    allowedClasses: {
        ul: false
    },
    allowProtocolRelative: false,
    allowedSchemes: ALLOWED_SCHEMES
});
//expected <ul class="should not sanitize"><li>Hello </li></ul>
console.log(sanitized)

What kind of change does this PR introduce?

(Check at least one)

  • Bug fix
  • New feature
  • Refactor
  • Documentation
  • Build-related changes
  • Other

Make sure the PR fulfills these requirements:

  • It includes a) the existing issue ID being resolved, b) a convincing reason for adding this feature, or c) a clear description of the bug it resolves
  • The changelog is updated
  • Related documentation has been updated
  • Related tests have been updated

Other information:

@KevinSJ
Copy link
Copy Markdown
Contributor Author

KevinSJ commented Jun 13, 2023

@boutell would you be able to merge this?

@boutell boutell merged commit 7df9d8b into apostrophecms:main Jun 13, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants