daisy
daisy

Reputation: 23571

sanitizeHtml failed to work, all other normal texts are removed unexpectly

I need to transform the <e> tag to <a> tag, and keep everything else escaped rather than removed.

However sanitize-html not only failed to process the self closing <e> tag, it also killed the <?php part.

I created a minimal case to test:

yarn add [email protected]

And main.js:

let sanitizeHTML = require('sanitize-html')
let rawHtml = `
<e type="mention" title="@user1" />

How to output phpinfo:

<?php
phpinfo();
?>

test
`
const clean = sanitizeHTML(rawHtml, {
  allowedTags: ['a', 'e', 'span'],
  disallowedTagsMode: 'escape',
  selfClosing: ['e'],
  transformTags: {
    'e': function(tagName, attribs) {
      if (attribs['type'] == 'web') {
        return {
          tagName: 'a',
          attribs
        }
      } else {
        return {
          tagName: 'span',
          attribs,
          text: attribs['title']
        }
      }
    }
  }
})

console.log(clean)

I expect the output to be:

<span>@user1</span>

How to output phpinfo:

<?php
phpinfo();
?>

test

But instead it was this (the <?php tag and the "test" string is removed)

<span>@user1</span>

Does anyone know what's wrong?

Upvotes: 1

Views: 97

Answers (0)

Related Questions