Fix to sanitize by default

wooorm · wooorm · commit b0b1ba5c55a5 · 2021-09-07T16:19:11.000+02:00
The docs have always said `remark-html` is safe by default.
It wasn’t and this patches that.

If you do want to be unsafe, use `remark-html` with `sanitize: false`:

```diff
  -.use(remarkHtml)
  +.use(remarkHtml, {sanitize: false})
```
diff --git a/index.js b/index.js
@@ -7,24 +7,34 @@ var sanitize = require('hast-util-sanitize')
 module.exports = plugin
 
 function plugin(options) {
-  var settings = options || {}
-  var clean = settings.sanitize
-  var schema = clean && typeof clean === 'object' ? clean : null
-  var handlers = settings.handlers || {}
+  var settings = Object.assign({}, options || {})
+  let clean
+
+  if (typeof settings.sanitize === 'boolean') {
+    clean = settings.sanitize
+    settings.sanitize = undefined
+  }
+
+  if (typeof clean !== 'boolean') {
+    clean = true
+  }
 
   this.Compiler = compiler
 
   function compiler(node, file) {
     var root = node && node.type && node.type === 'root'
-    var hast = toHast(node, {allowDangerousHtml: !clean, handlers: handlers})
+    var hast = toHast(node, {
+      allowDangerousHtml: !clean,
+      handlers: settings.handlers
+    })
     var result
 
     if (file.extname) {
       file.extname = '.html'
     }
 
     if (clean) {
-      hast = sanitize(hast, schema)
+      hast = sanitize(hast, settings.sanitize)
     }
 
     result = toHtml(
diff --git a/test/index.js b/test/index.js
@@ -37,7 +37,7 @@ test('remark-html()', function (t) {
     'should throw when not given a node'
   )
 
-  processor = remark().use(html)
+  processor = remark().use(html, {sanitize: false})
 
   t.equal(
     processor.stringify({type: 'alpha'}),
@@ -69,6 +69,7 @@ test('remark-html()', function (t) {
   )
 
   processor = remark().use(html, {
+    sanitize: false,
     handlers: {
       paragraph: function (h, node) {
         node.children[0].value = 'changed'
@@ -91,7 +92,7 @@ test('remark-html()', function (t) {
         }
       }
     })
-    .use(html)
+    .use(html, {sanitize: false})
 
   t.equal(
     processor.processSync('![hello](example.jpg "overwritten")').toString(),
@@ -105,7 +106,7 @@ test('remark-html()', function (t) {
         ast.children[0].children[0].data = {hName: 'b'}
       }
     })
-    .use(html)
+    .use(html, {sanitize: false})
 
   t.equal(
     processor.processSync('**Bold!**').toString(),
@@ -130,7 +131,7 @@ test('remark-html()', function (t) {
         }
       }
     })
-    .use(html)
+    .use(html, {sanitize: false})
 
   t.equal(
     processor.processSync('`var`').toString(),
@@ -171,7 +172,7 @@ test('remark-html()', function (t) {
         }
       }
     })
-    .use(html)
+    .use(html, {sanitize: false})
 
   t.equal(
     processor.processSync('```js\nvar\n```\n').toString(),
@@ -180,7 +181,10 @@ test('remark-html()', function (t) {
   )
 
   t.equal(
-    remark().use(html).processSync('## Hello <span>world</span>').toString(),
+    remark()
+      .use(html, {sanitize: false})
+      .processSync('## Hello <span>world</span>')
+      .toString(),
     '<h2>Hello <span>world</span></h2>\n',
     'should be `sanitation: false` by default'
   )
@@ -199,7 +203,7 @@ test('remark-html()', function (t) {
       .use(html, {sanitize: null})
       .processSync('## Hello <span>world</span>')
       .toString(),
-    '<h2>Hello <span>world</span></h2>\n',
+    '<h2>Hello world</h2>\n',
     'should support sanitation: null'
   )
 
@@ -267,7 +271,7 @@ test('CommonMark', function (t) {
 
     var actual = unified()
       .use(parse)
-      .use(html)
+      .use(html, {sanitize: false})
       .processSync(example.markdown)
       .toString()
 

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ test('remark-html()', function (t) {`
`37`	`37`	`'should throw when not given a node'`
`38`	`38`	`)`
`39`	`39`
`40`		`- processor = remark().use(html)`
	`40`	`+ processor = remark().use(html, {sanitize: false})`
`41`	`41`
`42`	`42`	`t.equal(`
`43`	`43`	`processor.stringify({type: 'alpha'}),`
`@@ -69,6 +69,7 @@ test('remark-html()', function (t) {`
`69`	`69`	`)`
`70`	`70`
`71`	`71`	`processor = remark().use(html, {`
	`72`	`+ sanitize: false,`
`72`	`73`	`handlers: {`
`73`	`74`	`paragraph: function (h, node) {`
`74`	`75`	`node.children[0].value = 'changed'`
`@@ -91,7 +92,7 @@ test('remark-html()', function (t) {`
`91`	`92`	`}`
`92`	`93`	`}`
`93`	`94`	`})`
`94`		`- .use(html)`
	`95`	`+ .use(html, {sanitize: false})`
`95`	`96`
`96`	`97`	`t.equal(`
`97`	`98`	`processor.processSync('![hello](example.jpg "overwritten")').toString(),`
`@@ -105,7 +106,7 @@ test('remark-html()', function (t) {`
`105`	`106`	`ast.children[0].children[0].data = {hName: 'b'}`
`106`	`107`	`}`
`107`	`108`	`})`
`108`		`- .use(html)`
	`109`	`+ .use(html, {sanitize: false})`
`109`	`110`
`110`	`111`	`t.equal(`
`111`	`112`	`processor.processSync('Bold!').toString(),`
`@@ -130,7 +131,7 @@ test('remark-html()', function (t) {`
`130`	`131`	`}`
`131`	`132`	`}`
`132`	`133`	`})`
`133`		`- .use(html)`
	`134`	`+ .use(html, {sanitize: false})`
`134`	`135`
`135`	`136`	`t.equal(`
`136`	`137`	processor.processSync('`var`').toString(),
`@@ -171,7 +172,7 @@ test('remark-html()', function (t) {`
`171`	`172`	`}`
`172`	`173`	`}`
`173`	`174`	`})`
`174`		`- .use(html)`
	`175`	`+ .use(html, {sanitize: false})`
`175`	`176`
`176`	`177`	`t.equal(`
`177`	`178`	processor.processSync('```js\nvar\n```\n').toString(),
`@@ -180,7 +181,10 @@ test('remark-html()', function (t) {`
`180`	`181`	`)`
`181`	`182`
`182`	`183`	`t.equal(`
`183`		`- remark().use(html).processSync('## Hello <span>world</span>').toString(),`
	`184`	`+ remark()`
	`185`	`+ .use(html, {sanitize: false})`
	`186`	`+ .processSync('## Hello <span>world</span>')`
	`187`	`+ .toString(),`
`184`	`188`	`'<h2>Hello <span>world</span></h2>\n',`
`185`	`189`	'should be `sanitation: false` by default'
`186`	`190`	`)`
`@@ -199,7 +203,7 @@ test('remark-html()', function (t) {`
`199`	`203`	`.use(html, {sanitize: null})`
`200`	`204`	`.processSync('## Hello <span>world</span>')`
`201`	`205`	`.toString(),`
`202`		`- '<h2>Hello <span>world</span></h2>\n',`
	`206`	`+ '<h2>Hello world</h2>\n',`
`203`	`207`	`'should support sanitation: null'`
`204`	`208`	`)`
`205`	`209`
`@@ -267,7 +271,7 @@ test('CommonMark', function (t) {`
`267`	`271`
`268`	`272`	`var actual = unified()`
`269`	`273`	`.use(parse)`
`270`		`- .use(html)`
	`274`	`+ .use(html, {sanitize: false})`
`271`	`275`	`.processSync(example.markdown)`
`272`	`276`	`.toString()`
`273`	`277`