Skip to content

Commit

Permalink
chore: tweak changeset
Browse files Browse the repository at this point in the history
  • Loading branch information
quantizor committed Aug 18, 2024
1 parent 2552602 commit 2c3adbd
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions .changeset/tricky-poems-collect.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,21 @@

Allow modifying HTML attribute sanitization when `options.sanitizer` is passed by the composer.

By default a lightweight URL sanitizer function is provided to avoid common attack vectors that might be placed into the `href` of an anchor tag, for example. The sanitizer receives the input, the HTML tag being targeted, the attribute name, and the default sanitizer as a fallback if you only need special handling for certain cases.
By default a lightweight URL sanitizer function is provided to avoid common attack vectors that might be placed into the `href` of an anchor tag, for example. The sanitizer receives the input, the HTML tag being targeted, and the attribute name. The original function is available as a library export called `sanitizer`.

This can be overridden and replaced with a custom sanitizer if desired via `options.sanitizer`:

```jsx
// sanitizer in this situation would receive:
// ('javascript:alert("foo")', 'a', 'href', fn)
// ('javascript:alert("foo")', 'a', 'href')

;<Markdown options={{ sanitizer: (value, tag, attribute, defaultFn) => value }}>
;<Markdown options={{ sanitizer: (value, tag, attribute) => value }}>
{`[foo](javascript:alert("foo"))`}
</Markdown>

// or

compiler('[foo](javascript:alert("foo"))', {
sanitizer: (value, tag, attribute, defaultFn) => value,
sanitizer: (value, tag, attribute) => value,
})
```

0 comments on commit 2c3adbd

Please sign in to comment.