Reputation: 23571
I need to transform the <e>
tag to <a>
tag, and keep everything else escaped rather than removed.
However sanitize-html not only failed to process the self closing <e>
tag, it also killed the <?php
part.
I created a minimal case to test:
yarn add [email protected]
And main.js:
let sanitizeHTML = require('sanitize-html')
let rawHtml = `
<e type="mention" title="@user1" />
How to output phpinfo:
<?php
phpinfo();
?>
test
`
const clean = sanitizeHTML(rawHtml, {
allowedTags: ['a', 'e', 'span'],
disallowedTagsMode: 'escape',
selfClosing: ['e'],
transformTags: {
'e': function(tagName, attribs) {
if (attribs['type'] == 'web') {
return {
tagName: 'a',
attribs
}
} else {
return {
tagName: 'span',
attribs,
text: attribs['title']
}
}
}
}
})
console.log(clean)
I expect the output to be:
<span>@user1</span>
How to output phpinfo:
<?php
phpinfo();
?>
test
But instead it was this (the <?php tag and the "test" string is removed)
<span>@user1</span>
Does anyone know what's wrong?
Upvotes: 1
Views: 97