Skip to content

Commit

Permalink
Add a way to disable attribute sanitization in inline HTML rendering.
Browse files Browse the repository at this point in the history
  • Loading branch information
LambdAurora committed Dec 2, 2024
1 parent 0635af5 commit c2aff27
Show file tree
Hide file tree
Showing 4 changed files with 9 additions and 3 deletions.
4 changes: 4 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -93,3 +93,7 @@

- Added allowed attributes in inline HTML rendering option.
- Fixed bad handling of malformed image elements.

### 2.3.1

- Added a way to disable attribute sanitization in inline HTML rendering.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,5 @@ import * as md from "@lambdaurora/libmd";
Import the library using [esm.sh](https://esm.sh):

```javascript
import * as md from "https://esm.sh/jsr/@lambdaurora/[email protected].0";
import * as md from "https://esm.sh/jsr/@lambdaurora/[email protected].1";
```
2 changes: 1 addition & 1 deletion deno.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@lambdaurora/libmd",
"version": "2.3.0",
"version": "2.3.1",
"exports": "./mod.ts",
"tasks": {
"build": "deno run --allow-read --allow-write --allow-net --allow-env=HOME,ESBUILD_BINARY_PATH,ESBUILD_WORKER_THREADS,XDG_CACHE_HOME,NPM_CONFIG_REGISTRY,DENO_REGISTRY_URL,JSR_URL --allow-run build_logic/build.ts",
Expand Down
4 changes: 3 additions & 1 deletion lib/renderer.ts
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ export interface InlineHtmlRenderOptions {
/**
* List of allowed attributes per HTML tags, with the special key `*` applying to all HTML tags.
*/
allowed_attributes: { [key: string]: readonly string[] };
allowed_attributes: { [key: string]: readonly string[] } | true;
/**
* List of HTML tags that are not allowed and will be escaped out.
*/
Expand Down Expand Up @@ -425,6 +425,8 @@ const DEFAULT_OPTIONS: RenderOptions = {
}

function sanitize_raw<N extends html.Node>(node: N, context: RenderContext): N {
if (context.inline_html.allowed_attributes === true) return node;

if (node instanceof html.Element) {
node.attributes = node.attributes.filter(attribute =>
context.inline_html.allowed_attributes["*"].includes(attribute.name)
Expand Down

0 comments on commit c2aff27

Please sign in to comment.