Skip to content
This repository was archived by the owner on Feb 26, 2026. It is now read-only.
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,4 @@ node_modules
.idea
# We do not commit CSS, only LESS
public/css/*.css
.vscode
20 changes: 16 additions & 4 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,15 @@ function sanitizeHtml(html, options, _recursing) {
options = Object.assign({}, sanitizeHtml.defaults, options);
options.parser = Object.assign({}, htmlParserDefaults, options.parser);

const tagAllowed = function (name) {
const { selfClosing } = options;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Localized and then never used in a localized away again because of the reassignment for the array case. So I think it would be clearer if we didn't do this at all and just referred to options.selfClosing throughout this bit.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README must be updated to cover this new syntax.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay on this one!

if (Array.isArray(selfClosing)) {
options.selfClosing = {};
for (const tag of selfClosing) {
options.selfClosing[tag] = true;
}
}

const tagAllowed = function(name) {
return options.allowedTags === false || (options.allowedTags || []).indexOf(name) > -1;
};

Expand Down Expand Up @@ -485,15 +493,19 @@ function sanitizeHtml(html, options, _recursing) {
}
});
}
if (options.selfClosing.indexOf(name) !== -1) {
result += ' />';

if (Object.hasOwn(options.selfClosing, name)) {
result += options.selfClosing[name]?.voidElement === true
? '>'
: ' />';
} else {
result += '>';
if (frame.innerText && !hasText && !options.textFilter) {
result += escapeHtml(frame.innerText);
addedText = true;
}
}

if (skip) {
result = tempResult + escapeHtml(result);
tempResult = '';
Expand Down Expand Up @@ -585,7 +597,7 @@ function sanitizeHtml(html, options, _recursing) {

if (
// Already output />
options.selfClosing.indexOf(name) !== -1 ||
options.selfClosing[name] ||
// Escaped tag, closing tag is implied
(isImplied && !tagAllowed(name) && [ 'escape', 'recursiveEscape' ].indexOf(options.disallowedTagsMode) >= 0)
) {
Expand Down
Loading