? Function(String)? addLinkRel;
SaneHtmlValidator({
+ required this.allowElements,
required this.allowElementId,
required this.allowClassName,
required this.addLinkRel,
@@ -256,7 +258,8 @@ class SaneHtmlValidator {
void _sanitize(Node node) {
if (node is Element) {
final tagName = node.localName!.toUpperCase();
- if (!_allowedElements.contains(tagName)) {
+ if (!_allowedElements.contains(tagName) &&
+ !(allowElements?.call(tagName) ?? false)) {
node.remove();
return;
}
diff --git a/sanitize_html/pubspec.yaml b/sanitize_html/pubspec.yaml
index abf77efd..f6d20958 100644
--- a/sanitize_html/pubspec.yaml
+++ b/sanitize_html/pubspec.yaml
@@ -1,5 +1,5 @@
name: sanitize_html
-version: 2.2.0
+version: 2.3.0
description: >-
Function for sanitizing HTML to prevent XSS by restrict elements and
attributes to a safe subset of allowed values.
diff --git a/sanitize_html/test/sanitize_html_test.dart b/sanitize_html/test/sanitize_html_test.dart
index c29e3f23..bf7cfddc 100644
--- a/sanitize_html/test/sanitize_html_test.dart
+++ b/sanitize_html/test/sanitize_html_test.dart
@@ -29,6 +29,7 @@ void main() {
return sanitizeHtml(
template,
+ allowElements: (tagName) => tagName == 'ONLY-ALLOWED-TAG',
allowElementId: (id) => id == 'only-allowed-id',
allowClassName: (className) => className == 'only-allowed-class',
addLinkRel: (href) => href == 'bad-link' ? ['ugc', 'nofollow'] : null,
@@ -65,6 +66,13 @@ void main() {
testContains('hello', '
');
testContains('hello', '
');
+ // test tag name filtering
+ testContains(
+ 'hello', '');
+ testContains('hello', 'hello');
+ testNotContains('hello', 'disallowed-tag');
+ testNotContains('hello', 'hello');
+
// test id filtering..
testContains('hello', 'id');
testContains('hello', 'only-allowed-id');
@@ -185,6 +193,8 @@ void main() {
withOptionalConfiguration: false);
testNotContains('hey', 'rel=',
withOptionalConfiguration: false);
+ testNotContains('hello', 'hello',
+ withOptionalConfiguration: false);
testNotContains('hello', 'id=',
withOptionalConfiguration: false);
testNotContains('hello', 'class=',