fix: support text for * transformer

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.17.1 (2025-09-02)
+
+- Fix text option not being considered for transformTags when tag is *
+
 ## 2.17.0 (2025-05-14)
 
 - Add `preserveEscapedAttributes`, allowing attributes on escaped disallowed tags to be retained. Thanks to [Ben Elliot](https://github.com/benelliott) for this new option.

index.js

@@ -258,6 +258,11 @@ function sanitizeHtml(html, options, _recursing) {
         transformedTag = transformTagsAll(name, attribs);
 
         frame.attribs = attribs = transformedTag.attribs;
+
+        if (transformedTag.text !== undefined) {
+          frame.innerText = transformedTag.text;
+        }
+
         if (name !== transformedTag.tagName) {
           frame.name = name = transformedTag.tagName;
           transformMap[depth] = transformedTag.tagName;

test/test.js

@@ -241,10 +241,23 @@ describe('sanitizeHtml', function() {
       }
     }), '<a href="http://somelink"></a>');
   });
-  it('should replace text and attributes when they are changed by transforming function and textFilter is set', function () {
+  it('should replace text and attributes when they are changed by transforming function', function () {
     assert.equal(sanitizeHtml('<a href="http://somelink">some text</a>', {
       transformTags: {
         a: function (tagName, attribs) {
+          return {
+            tagName: tagName,
+            attribs: attribs,
+            text: ''
+          };
+        }
+      }
+    }), '<a href="http://somelink"></a>');
+  });
+  it('should replace text and attributes for wildcard tag when they are changed by transforming function and textFilter is set', function () {
+    assert.equal(sanitizeHtml('<a href="http://somelink">some text</a>', {
+      transformTags: {
+        '*': function (tagName, attribs) {
           return {
             tagName: tagName,
             attribs: attribs,