diff --git a/install/package.json b/install/package.json index c396d1457a..9cb643b3b7 100644 --- a/install/package.json +++ b/install/package.json @@ -108,7 +108,7 @@ "request-promise-native": "^1.0.8", "rimraf": "3.0.2", "rss": "^1.2.2", - "sanitize-html": "^1.23.0", + "sanitize-html": "^2.0.0", "semver": "^7.2.1", "serve-favicon": "^2.5.0", "sharp": "0.26.1", @@ -172,4 +172,4 @@ "url": "https://github.com/barisusakli" } ] -} \ No newline at end of file +} diff --git a/src/posts/parse.js b/src/posts/parse.js index 208abbaebc..87e8e7f44d 100644 --- a/src/posts/parse.js +++ b/src/posts/parse.js @@ -14,15 +14,13 @@ var utils = require('../utils'); let sanitizeConfig = { allowedTags: sanitize.defaults.allowedTags.concat([ // Some safe-to-use tags to add - 'span', 'a', 'pre', 'small', - 'sup', 'sub', 'u', 'del', + 'sup', 'ins', 'del', 'img', 'button', 'video', 'audio', 'iframe', 'embed', - 'img', 'tfoot', 'h1', 'h2', - 's', 'button', 'i', + // 'sup' still necessary until https://github.com/apostrophecms/sanitize-html/pull/422 merged ]), allowedAttributes: { ...sanitize.defaults.allowedAttributes, - a: ['href', 'hreflang', 'media', 'rel', 'target', 'type'], + a: ['href', 'name', 'hreflang', 'media', 'rel', 'target', 'type'], img: ['alt', 'height', 'ismap', 'src', 'usemap', 'width', 'srcset'], iframe: ['height', 'name', 'src', 'width'], video: ['autoplay', 'controls', 'height', 'loop', 'muted', 'poster', 'preload', 'src', 'width'],