Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The style attribute of a span is filtered out by the XSS package #4

Open
teilzeitgeist opened this issue May 4, 2022 · 3 comments
Open
Labels
⚡️ feature Super New feature

Comments

@teilzeitgeist
Copy link

Hey!

Can you please add attributes like style to the whiteList of the XSS package?

const sanitized = xss(rawHtml);

Right now your linkify directive filtering attributes like this out:
<span style="text-decoration: underline">Underline</span>

What is your opinion?

Thanks for your work!

Cheers Chris :)

@say8425
Copy link
Owner

say8425 commented May 6, 2022

I see your point.

whiteList: {
  span: ["style"]
},

js xss supports whitelist and this option looks good to allow style attribute on a span tag.
So I will add another option parameter to bind js xss option on this weekend then you can pass style attribute with span tag on this parameter as whitelist. Thanks 😊

@say8425 say8425 added the ⚡️ feature Super New feature label May 6, 2022
teilzeitgeist pushed a commit to teilzeitgeist/vue-3-linkify that referenced this issue Jul 18, 2022
@teilzeitgeist
Copy link
Author

teilzeitgeist commented Jul 18, 2022

Did not test my code but if you like you can check and merge it :)

@say8425
Copy link
Owner

say8425 commented Jul 20, 2022

@Psyphant Hello. Sorry for late, I was release version 2 beta.
You can also use xss option.

Please test with this library. I'm on vacation now until next week so I can focus on this project. Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
⚡️ feature Super New feature
Projects
None yet
Development

No branches or pull requests

2 participants