{"_id":"@angstone/insane","_rev":"1-7558a992c694b530fd92a4d6fae995af","name":"@angstone/insane","dist-tags":{"latest":"2.7.0"},"versions":{"2.7.0":{"name":"@angstone/insane","version":"2.7.0","description":"Lean and configurable whitelist-oriented HTML sanitizer","repository":{"type":"git","url":"git+https://github.com/angstone/insane.git"},"author":{"name":"Nicolas Bevacqua","email":"nicolasbevacqua@gmail.com","url":"https://ponyfoo.com/"},"license":"MIT","bugs":{"url":"https://github.com/angstone/insane/issues"},"homepage":"https://github.com/angstone/insane","main":"insane.js","browser":{"he":"./she.js"},"scripts":{"test":"tape test/**/*.js"},"dependencies":{"assignment":"2.0.0","he":"0.5.0"},"devDependencies":{"sinon":"1.17.5","tape":"3.5.0"},"gitHead":"7dd5f41a10488d4df817b9b0d0637a5902112ae1","_id":"@angstone/insane@2.7.0","_nodeVersion":"14.17.1","_npmVersion":"6.14.13","dist":{"integrity":"sha512-a3W/Lk3cDNPCFAGGSikNFQrSkHPFqwGoL9Bn6HXPb9XCtYMK7mLWWw+dJPPARBrar3bKVX8kNf8frbYYpSFMXg==","shasum":"dfc585ed7dd1befa31f2f56a5892553736972f3b","tarball":"https://registry.npmjs.org/@angstone/insane/-/insane-2.7.0.tgz","fileCount":16,"unpackedSize":18140,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJg1zdLCRA9TVsSAnZWagAAB0kP/2ZCBT/9Yp8QbWiV0BsC\nub44MtCLjp6oyFgtX4rr7AKrXeYP/ZJN9jEm9Jgu6SoEPdfkClIVdXT7+vD8\n+mlZLYd6VihkdbOPtET31jm6UG/apaRuoUG+DbaAf6H8KZz6zwMDjVE5m+ih\nmdpsUj2tZXlTw0v/hLML2ghNsrbotgCdgMC5Ymk6gEGQ3W+MZF9w1FW7/Pd6\n09Mz0NwhEtQI5Fs7NBWMBo8pnyB5ToKjTGGpJS11/NCMxuKt9QMNa8UH4JSa\n2iYU2SuSvDo3oWB09Z+Dxr8un6cNUfXZiXhyNil4Zv2aqNM/K8B6girgJmmr\n8rcLQRJQ7P45TJT9dhK84qUaK9MCMjrLeBFYQUOxuR/lEI37qXa8KP9FPuPt\nJc15tGnorN6by9ZavVULHdf6w98rqP5zgKi19IkcTBUUihUExoIJWKrUGFMe\ndLvNhB8ne/4J7+YcmhQahFJrXEk6Bz2LYFjNKQT7mcgbWatLsYawfJmpAQYD\nITd0fl94hZIoXS24PDVEx9QJAfxgO8XEoE/1iNODJL6cpiGJZY5X7btv9VIG\n7bnbWDXjlcFRKP4PDWgtp9kbmtPOAt5RO56/uby9SAHG23mQSBB89neVTTid\n94zKu2QNFkN1QzDmSMUCgL58uPI68fcMizos5p3ZSsH1ptirRkFfKVBd5wAW\nPGBa\r\n=LDGu\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCeLvIbnNC1x/Z5Ew2zTVL4OcLOS+rpo6SlOwDTXLixeAIhAPjt3PAfZeHYUlsL3cX04KWbtnqXl+p8fi/ACyXRW5bB"}]},"_npmUser":{"name":"ssribeiro","email":"luan@ssribeiro.com"},"directories":{},"maintainers":[{"name":"ssribeiro","email":"luan@ssribeiro.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/insane_2.7.0_1624717131227_0.8180255590381176"},"_hasShrinkwrap":false}},"time":{"created":"2021-06-26T14:18:51.051Z","2.7.0":"2021-06-26T14:18:51.335Z","modified":"2022-04-04T14:06:30.136Z"},"maintainers":[{"name":"ssribeiro","email":"luan@ssribeiro.com"}],"description":"Lean and configurable whitelist-oriented HTML sanitizer","homepage":"https://github.com/angstone/insane","repository":{"type":"git","url":"git+https://github.com/angstone/insane.git"},"author":{"name":"Nicolas Bevacqua","email":"nicolasbevacqua@gmail.com","url":"https://ponyfoo.com/"},"bugs":{"url":"https://github.com/angstone/insane/issues"},"license":"MIT","readme":"# ANGSTONE CHANGES ON THE ORIGINAL:\n\nThe only one change we made was add the option: **throwAsValidationError**\n\nAs the option name suggests, it will throw an immediate error it finds a not allowed tag instead of only remove it.\nThis expands original functionality and allows check code beyond just sanitizing.\n\noriginal: https://github.com/bevacqua/insane.git\n\n# insane\n\n> Lean and configurable whitelist-oriented HTML sanitizer\n\nWorks well in browsers, as its footprint size is very small _(around **~2kb** gzipped)_. API inspired by [`sanitize-html`][1] _(which is around **100kb** gzipped)_.\n\n**You would be insane not to use this!**\n\n# Install\n\n```shell\nnpm install insane --save\n```\n\n# Usage\n\n```js\ninsane(\"
foobar
\", { allowedTags: [\"div\"] });\n// <- '
foo
'\n```\n\nContrary to similar sanitizers, `insane` drops the whole tree of descendants for elements that aren't allowed tags.\n\n# API\n\n# `insane(html, options?, strict?)`\n\n- `html` can be an arbitrary HTML string\n- `options` are detailed below\n- `strict` means that `options` won't be based off of [insane.defaults](#defaults) if set to `true`\n\nThe parser takes into account that some elements can be self-closing. For safety reasons the sanitizer will only accept a valid URL for `background`, `base`, `cite`, `href`, `longdesc`, `src`, and `usemap` elements. **\"Valid URL\"** means that it begins with either `#`, `/`, or any of `options.allowedSchemes` _(followed by `:`)_.\n\n## `options`\n\n[Sensible defaults](#defaults) are provided. You can override specific options as needed.\n\n#### `allowedSchemes`\n\nDefaults to `['http', 'https', 'mailto']`.\n\n#### `allowedTags`\n\nAn array of tags that you'll allow in the resulting HTML.\n\n###### Example\n\n> Only allow spans, discarding the rest of elements.\n\n```js\ninsane(\"
foo
bar\", {\n allowedTags: [\"span\"],\n});\n// <- 'bar'\n```\n\n#### `allowedAttributes`\n\nAn object describing the attributes you'll allow for each individual tag name.\n\n###### Example\n\n> Only allow spans, and only allow those spans to have an `id` _(discarding the rest of their attributes)_.\n\n```js\ninsane('bar', {\n allowedTags: [\"span\"],\n allowedAttributes: { span: [\"id\"] },\n});\n// <- 'bar'\n```\n\n#### `allowedClasses`\n\nIf `'class'` is listed as an allowed attribute, every single class will be allowed. If you don't list `'class'` as an allowed attribute, you can provide a class whitelist per tag name.\n\n###### Example\n\n> Only allow spans to have `super` or `bad` class names, discarding the rest of them.\n\n```js\ninsane('bar', {\n allowedTags: [\"span\"],\n allowedClasses: { span: [\"super\", \"bad\"] },\n});\n// <- 'bar'\n```\n\n#### `filter`\n\nTakes a `function(token)` that allows you to do additional validation beyond exact tag name and attribute matching. The `token` object passed to your filter contains the following properties.\n\n- `tag` is the lowercase tag name of the element\n- `attrs` is an object containing _every_ attribute in the element, **including** those that may not be in the whitelist\n\nIf you return a falsy value the element and all of its descendants will not be included in the output. Note that you are allowed to change the `attrs`, and even add new ones, transforming the output.\n\n###### Example\n\n> Require that `` elements have an `aria-label` value.\n\n```js\nfunction filter(token) {\n return token.tag !== \"span\" || token.attrs[\"aria-label\"];\n}\ninsane('foobar', {\n allowedTags: [\"span\"],\n allowedAttributes: { span: [\"aria-label\"] },\n filter: filter,\n});\n// <- 'foo'\n```\n\n#### `transformText`\n\nTakes a `function(text)` that allows you to modify text content in HTML elements. Runs for every piece of text content. The returned value is used instead of the original text contents.\n\n## Defaults\n\nThe default configuration is used if you don't provide any. This object is available at `insane.defaults`. You are free to manipulate the defaults themselves.\n\n```json\n{\n \"allowedAttributes\": {\n \"a\": [\"href\", \"name\", \"target\"],\n \"iframe\": [\"allowfullscreen\", \"frameborder\", \"src\"],\n \"img\": [\"src\"]\n },\n \"allowedClasses\": {},\n \"allowedSchemes\": [\"http\", \"https\", \"mailto\"],\n \"allowedTags\": [\n \"a\",\n \"article\",\n \"b\",\n \"blockquote\",\n \"br\",\n \"caption\",\n \"code\",\n \"del\",\n \"details\",\n \"div\",\n \"em\",\n \"h1\",\n \"h2\",\n \"h3\",\n \"h4\",\n \"h5\",\n \"h6\",\n \"hr\",\n \"i\",\n \"img\",\n \"ins\",\n \"kbd\",\n \"li\",\n \"main\",\n \"ol\",\n \"p\",\n \"pre\",\n \"section\",\n \"span\",\n \"strike\",\n \"strong\",\n \"sub\",\n \"summary\",\n \"sup\",\n \"table\",\n \"tbody\",\n \"td\",\n \"th\",\n \"thead\",\n \"tr\",\n \"u\",\n \"ul\"\n ],\n \"filter\": null,\n \"transformText\": null\n}\n```\n\n# License\n\nMIT\n\n[1]: https://github.com/punkave/sanitize-html\n","readmeFilename":"readme.markdown"}