codex-team / codex-team/editor.js
Replace html_janitor with sanitize-html
- Dominant language
- TypeScript
- Stars
- 31.9k
- Forks
- 2.2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 1
Description
Hi, I just wondered if sanitize-html will not be a good candidate to replace html-janitor
I say this because:
1) html-janitor has a security issue XSS Note :
This library has not been extensively tested. In particular versions prior to 2.0.3 are vulnerable to XSS attacks.
This vulnerability is fully described there: https://hackerone.com/reports/308155
2) sanitze-html is well suited for cleaning up HTML fragments such as those created by ckeditor and other rich text editors. It is especially handy for removing unwanted CSS when copying and pasting from Word.
https://www.npmjs.com/package/sanitize-html
worth it or not?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.