Merge pull request #675 from anak-dev/anak-dev-main

fix: `allowedClasses` whitelist ignored if tag is wildcard
apostrophecms · Sep 23, 2024 · c0a7bbd · c0a7bbd
2 parents f47281e + 5588fd8
commit c0a7bbd
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Fix to allow regex in `allowedClasses` wildcard whitelist. 
+
 ## 2.13.0 (2024-03-20)
 
 - Documentation update regarding minimum supported TypeScript version.

diff --git a/index.js b/index.js
@@ -431,12 +431,13 @@ function sanitizeHtml(html, options, _recursing) {
               const allowedWildcardClasses = allowedClassesMap['*'];
               const allowedSpecificClassesGlob = allowedClassesGlobMap[name];
               const allowedSpecificClassesRegex = allowedClassesRegexMap[name];
+              const allowedWildcardClassesRegex = allowedClassesRegexMap['*'];
               const allowedWildcardClassesGlob = allowedClassesGlobMap['*'];
               const allowedClassesGlobs = [
                 allowedSpecificClassesGlob,
                 allowedWildcardClassesGlob
               ]
-                .concat(allowedSpecificClassesRegex)
+                .concat(allowedSpecificClassesRegex, allowedWildcardClassesRegex)
                 .filter(function (t) {
                   return t;
                 });

diff --git a/test/test.js b/test/test.js
@@ -510,6 +510,19 @@ describe('sanitizeHtml', function() {
       '<p class="nifty33 dippy">whee</p>'
     );
   });
+  it('should allow classes that match `allowedClasses` regex for all tags', function() {
+    assert.equal(
+      sanitizeHtml(
+        '<p class="nifty33 nifty2 dippy">whee</p>',
+        {
+          allowedClasses: {
+            '*': [ /^nifty\d{2}$/, /^d\w{4}$/ ]
+          }
+        }
+      ),
+      '<p class="nifty33 dippy">whee</p>'
+    );
+  });
   it('should allow defining schemes on a per-tag basis', function() {
     assert.equal(
       sanitizeHtml(