codex-team / codex-team/editor.js

Replace html_janitor with sanitize-html

Open
#1,275 5 comments 6 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
31.9k
Forks
2.2k
Avg merge
1d 1h
Merged PRs (30d)
1

Description

Hi, I just wondered if sanitize-html will not be a good candidate to replace html-janitor

I say this because:

1) html-janitor has a security issue XSS Note :
This library has not been extensively tested. In particular versions prior to 2.0.3 are vulnerable to XSS attacks.
This vulnerability is fully described there: https://hackerone.com/reports/308155
2) sanitze-html is well suited for cleaning up HTML fragments such as those created by ckeditor and other rich text editors. It is especially handy for removing unwanted CSS when copying and pasting from Word.
https://www.npmjs.com/package/sanitize-html

worth it or not?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.