3
3
[ ![ Build] [ build-badge ]] [ build ]
4
4
[ ![ Coverage] [ coverage-badge ]] [ coverage ]
5
5
[ ![ Downloads] [ downloads-badge ]] [ downloads ]
6
+ [ ![ Size] [ size-badge ]] [ size ]
7
+ [ ![ Sponsors] [ sponsors-badge ]] [ collective ]
8
+ [ ![ Backers] [ backers-badge ]] [ collective ]
6
9
[ ![ Chat] [ chat-badge ]] [ chat ]
7
10
8
- Sanitize [ HAST ] [ ] .
11
+ [ ** hast ** ] [ hast ] utility to sanitize a [ * tree * ] [ tree ] .
9
12
10
- ## Installation
13
+ ## Install
11
14
12
15
[ npm] [ ] :
13
16
14
- ``` bash
17
+ ``` sh
15
18
npm install hast-util-sanitize
16
19
```
17
20
18
21
## Usage
19
22
20
- ``` javascript
23
+ ``` js
21
24
var h = require (' hastscript' )
22
25
var u = require (' unist-builder' )
23
26
var sanitize = require (' hast-util-sanitize' )
24
- var toHTML = require (' hast-util-to-html' )
27
+ var toHtml = require (' hast-util-to-html' )
25
28
26
29
var tree = h (' div' , {onmouseover: ' alert("alpha")' }, [
27
30
h (
@@ -39,8 +42,8 @@ var tree = h('div', {onmouseover: 'alert("alpha")'}, [
39
42
h (' math' , h (' mi' , {' xlink:href' : ' data:x,<script>alert("foxtrot")</script>' }))
40
43
])
41
44
42
- var unsanitized = toHTML (tree)
43
- var sanitized = toHTML (sanitize (tree))
45
+ var unsanitized = toHtml (tree)
46
+ var sanitized = toHtml (sanitize (tree))
44
47
45
48
console .log (unsanitized)
46
49
console .log (sanitized)
@@ -68,28 +71,28 @@ Sanitized:
68
71
69
72
## API
70
73
71
- ### ` sanitize(node [, schema]) `
74
+ ### ` sanitize(tree [, schema]) `
72
75
73
- Sanitize the given [ HAST ] [ ] tree.
76
+ Sanitize a [ ** hast ** ] [ hast ] [ * tree* ] [ tree ] .
74
77
75
78
###### Parameters
76
79
77
- * ` node ` ([ ` HASTNode ` ] [ hast ] ).
78
- * ` schema ` ([ ` Schema ` ] [ schema ] , optional).
80
+ * ` tree ` ([ ` Node ` ] [ node ] ) — [ * Tree * ] [ tree ] to sanitize
81
+ * ` schema ` ([ ` Schema ` ] [ schema ] , optional) — Schema defining how to sanitize
79
82
80
83
###### Returns
81
84
82
- [ ` HASTNode ` ] [ hast ] — A new node .
85
+ [ ` Node ` ] [ node ] — A new, sanitized [ * tree * ] [ tree ] .
83
86
84
87
### ` Schema `
85
88
86
- Configuration. If not given, defaults to [ GitHub] [ ] style sanitation.
89
+ Configuration.
90
+ If not given, defaults to [ GitHub] [ ] style sanitation.
87
91
If any top-level key isn’t given, it defaults to GH’s style too.
88
92
89
- For a thorough sample, see the packages [ ` github.json ` ] [ schema-github ] .
93
+ For a thorough sample, see [ ` github.json ` ] [ schema-github ] .
90
94
91
- To extend the standard schema with a few changes, clone ` github.json `
92
- like so:
95
+ To extend the standard schema with a few changes, clone ` github.json ` like so:
93
96
94
97
``` js
95
98
var h = require (' hastscript' )
@@ -107,12 +110,13 @@ console.log(tree)
107
110
108
111
###### ` attributes `
109
112
110
- Map of tag-names to allowed attributes (` Object.<Array.<string>> ` ).
113
+ Map of tag names to allowed [ * property names* ] [ name ]
114
+ (` Object.<Array.<string>> ` ).
111
115
112
- The special ` '*' ` key sets attributes allowed on all elements.
116
+ The special ` '*' ` key defines [ * property names* ] [ name ] allowed on all
117
+ [ * elements* ] [ element ] .
113
118
114
- One special value, namely ` 'data*' ` , can be used to allow all ` data `
115
- properties.
119
+ One special value, namely ` 'data*' ` , can be used to allow all ` data ` properties.
116
120
117
121
``` js
118
122
" attributes" : {
@@ -136,10 +140,10 @@ properties.
136
140
}
137
141
```
138
142
139
- Instead of a single string (such as ` type ` ), which allows any value of that
140
- attribute , it’s also possible to provide an array (such as ` [ 'type',
141
- ' checkbox'] `), where the first entry is the key, and the other entries are
142
- allowed values of that property.
143
+ Instead of a single string (such as ` type ` ), which allows any [ * property
144
+ value * ] [ value ] of that [ * property name * ] [ name ] , it’s also possible to provide
145
+ an array (such as ` ['type', ' checkbox']` ), where the first entry is the
146
+ * propery name * , and the other entries are allowed * property values * .
143
147
144
148
This is how the default GitHub schema allows only disabled checkbox inputs:
145
149
@@ -156,13 +160,13 @@ This is how the default GitHub schema allows only disabled checkbox inputs:
156
160
157
161
###### ` required `
158
162
159
- Map of tag- names to required attributes and their default values
160
- (` Object.<Object.<*>> ` ).
161
- If the properties in such a required attributes object do not exist on an
162
- element , they are added and set to the specified value.
163
+ Map of tag names to required [ * property names * ] [ name ] and their default
164
+ [ * property value * ] [ value ] (` Object.<Object.<*>> ` ).
165
+ If the defined keys do not exist in an [ * element * ] [ element ] ’s
166
+ [ * properties * ] [ properties ] , they are added and set to the specified value.
163
167
164
168
Note that properties are first checked based on the schema at ` attributes ` ,
165
- so properties could be removed by that step and then added again through
169
+ so * properties* could be removed by that step and then added again through
166
170
` required ` .
167
171
168
172
``` js
@@ -176,7 +180,7 @@ so properties could be removed by that step and then added again through
176
180
177
181
###### ` tagNames `
178
182
179
- List of allowed tag- names (` Array.<string> ` ).
183
+ List of allowed tag names (` Array.<string> ` ).
180
184
181
185
``` js
182
186
" tagNames" : [
@@ -192,7 +196,8 @@ List of allowed tag-names (`Array.<string>`).
192
196
193
197
###### ` protocols `
194
198
195
- Map of protocols to support for attributes (` Object.<Array.<string>> ` ).
199
+ Map of protocols to allow in [ * property values* ] [ value ]
200
+ (` Object.<Array.<string>> ` ).
196
201
197
202
``` js
198
203
" protocols" : {
@@ -211,7 +216,7 @@ Map of protocols to support for attributes (`Object.<Array.<string>>`).
211
216
212
217
###### ` ancestors `
213
218
214
- Map of tag- names to their required ancestral elements
219
+ Map of tag names to their required [ * ancestor * ] [ ancestor ] [ * elements* ] [ element ]
215
220
(` Object.<Array.<string>> ` ).
216
221
217
222
``` js
@@ -229,7 +234,7 @@ Map of tag-names to their required ancestral elements
229
234
230
235
###### ` clobber `
231
236
232
- List of allowed attribute- names which can clobber (` Array.<string> ` ).
237
+ List of allowed [ * property names* ] [ name ] which can clobber (` Array.<string> ` ).
233
238
234
239
``` js
235
240
" clobber" : [
@@ -240,18 +245,19 @@ List of allowed attribute-names which can clobber (`Array.<string>`).
240
245
241
246
###### ` clobberPrefix `
242
247
243
- Prefix ( ` string ` ) to use before potentially clobbering properties .
248
+ Prefix to use before potentially clobbering [ * property names * ] [ name ] ( ` string ` ) .
244
249
245
250
``` js
246
251
" clobberPrefix" : " user-content-"
247
252
```
248
253
249
254
###### ` strip `
250
255
251
- Tag-names to strip from the tree (` Array.<string> ` ).
256
+ Names of [ * elements* ] [ element ] to strip from the [ * tree* ] [ tree ]
257
+ (` Array.<string> ` ).
252
258
253
- By default, unsafe elements are replaced by their content. Some elements,
254
- should however be entirely stripped from the tree.
259
+ By default, unsafe * elements* are replaced by their [ * children * ] [ child ] .
260
+ Some * elements * , should however be entirely stripped from the * tree* .
255
261
256
262
``` js
257
263
" strip" : [
@@ -261,27 +267,29 @@ should however be entirely stripped from the tree.
261
267
262
268
###### ` allowComments `
263
269
264
- Whether to allow comment nodes (` boolean ` , default: ` false ` ).
270
+ Whether to allow [ * comments * ] [ comment ] (` boolean ` , default: ` false ` ).
265
271
266
272
``` js
267
273
" allowComments" : true
268
274
```
269
275
270
276
###### ` allowDoctypes `
271
277
272
- Whether to allow doctype nodes (` boolean ` , default: ` false ` ).
278
+ Whether to allow [ * doctypes * ] [ doctype ] (` boolean ` , default: ` false ` ).
273
279
274
280
``` js
275
281
" allowDoctypes" : true
276
282
```
277
283
278
284
## Contribute
279
285
280
- See [ ` contributing.md ` in ` syntax-tree/hast ` ] [ contributing ] for ways to get
286
+ See [ ` contributing.md ` in ` syntax-tree/.github ` ] [ contributing ] for ways to get
281
287
started.
288
+ See [ ` support.md ` ] [ support ] for ways to get help.
282
289
283
- This organisation has a [ Code of Conduct] [ coc ] . By interacting with this
284
- repository, organisation, or community you agree to abide by its terms.
290
+ This project has a [ Code of Conduct] [ coc ] .
291
+ By interacting with this repository, organisation, or community you agree to
292
+ abide by its terms.
285
293
286
294
## License
287
295
@@ -301,24 +309,56 @@ repository, organisation, or community you agree to abide by its terms.
301
309
302
310
[ downloads ] : https://www.npmjs.com/package/hast-util-sanitize
303
311
312
+ [ size-badge ] : https://img.shields.io/bundlephobia/minzip/hast-util-sanitize.svg
313
+
314
+ [ size ] : https://bundlephobia.com/result?p=hast-util-sanitize
315
+
316
+ [ sponsors-badge ] : https://opencollective.com/unified/sponsors/badge.svg
317
+
318
+ [ backers-badge ] : https://opencollective.com/unified/backers/badge.svg
319
+
320
+ [ collective ] : https://opencollective.com/unified
321
+
304
322
[ chat-badge ] : https://img.shields.io/badge/join%20the%20community-on%20spectrum-7b16ff.svg
305
323
306
- [ chat ] : https://spectrum.chat/unified/rehype
324
+ [ chat ] : https://spectrum.chat/unified/syntax-tree
307
325
308
326
[ npm ] : https://docs.npmjs.com/cli/install
309
327
310
328
[ license ] : license
311
329
312
330
[ author ] : https://wooorm.com
313
331
332
+ [ contributing ] : https://github.com/syntax-tree/.github/blob/master/contributing.md
333
+
334
+ [ support ] : https://github.com/syntax-tree/.github/blob/master/support.md
335
+
336
+ [ coc ] : https://github.com/syntax-tree/.github/blob/master/code-of-conduct.md
337
+
338
+ [ tree ] : https://github.com/syntax-tree/unist#tree
339
+
340
+ [ child ] : https://github.com/syntax-tree/unist#child
341
+
342
+ [ ancestor ] : https://github.com/syntax-tree/unist#ancestor
343
+
314
344
[ hast ] : https://github.com/syntax-tree/hast
315
345
316
- [ schema ] : #schema
346
+ [ node ] : https://github.com/syntax-tree/hast#nodes
347
+
348
+ [ element ] : https://github.com/syntax-tree/hast#element
349
+
350
+ [ doctype ] : https://github.com/syntax-tree/hast#doctype
351
+
352
+ [ comment ] : https://github.com/syntax-tree/hast#comment
353
+
354
+ [ properties ] : https://github.com/syntax-tree/hast#properties
355
+
356
+ [ name ] : https://github.com/syntax-tree/hast#propertyname
357
+
358
+ [ value ] : https://github.com/syntax-tree/hast#propertyvalue
317
359
318
360
[ github ] : https://github.com/jch/html-pipeline/blob/master/lib/html/pipeline/sanitization_filter.rb
319
361
320
362
[ schema-github ] : lib/github.json
321
363
322
- [ contributing ] : https://github.com/syntax-tree/hast/blob/master/contributing.md
323
-
324
- [ coc ] : https://github.com/syntax-tree/hast/blob/master/code-of-conduct.md
364
+ [ schema ] : #schema
0 commit comments