diff --git a/.changeset/nasty-knives-attack.md b/.changeset/nasty-knives-attack.md deleted file mode 100644 index fae6e031..00000000 --- a/.changeset/nasty-knives-attack.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'markdown-to-jsx': patch ---- - -Replace RuleType enum with an object diff --git a/.changeset/tricky-poems-collect.md b/.changeset/tricky-poems-collect.md deleted file mode 100644 index 0ee84dcf..00000000 --- a/.changeset/tricky-poems-collect.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -'markdown-to-jsx': minor ---- - -Allow modifying HTML attribute sanitization when `options.sanitizer` is passed by the composer. - -By default a lightweight URL sanitizer function is provided to avoid common attack vectors that might be placed into the `href` of an anchor tag, for example. The sanitizer receives the input, the HTML tag being targeted, and the attribute name. The original function is available as a library export called `sanitizer`. - -This can be overridden and replaced with a custom sanitizer if desired via `options.sanitizer`: - -```jsx -// sanitizer in this situation would receive: -// ('javascript:alert("foo")', 'a', 'href') - -; value }}> - {`[foo](javascript:alert("foo"))`} - - -// or - -compiler('[foo](javascript:alert("foo"))', { - sanitizer: (value, tag, attribute) => value, -}) -``` diff --git a/.yarn/cache/@esbuild-linux-x64-npm-0.19.11-2afe281ab0-10.zip b/.yarn/cache/@esbuild-linux-x64-npm-0.19.11-2afe281ab0-10.zip new file mode 100644 index 00000000..1937416d Binary files /dev/null and b/.yarn/cache/@esbuild-linux-x64-npm-0.19.11-2afe281ab0-10.zip differ diff --git a/CHANGELOG.md b/CHANGELOG.md index f5bfbe6e..4a7d3e11 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ # markdown-to-jsx +## 7.5.0 + +### Minor Changes + +- 62a16f3: Allow modifying HTML attribute sanitization when `options.sanitizer` is passed by the composer. + + By default a lightweight URL sanitizer function is provided to avoid common attack vectors that might be placed into the `href` of an anchor tag, for example. The sanitizer receives the input, the HTML tag being targeted, and the attribute name. The original function is available as a library export called `sanitizer`. + + This can be overridden and replaced with a custom sanitizer if desired via `options.sanitizer`: + + ```jsx + // sanitizer in this situation would receive: + // ('javascript:alert("foo")', 'a', 'href') + + ; value }}> + {`[foo](javascript:alert("foo"))`} + + + // or + + compiler('[foo](javascript:alert("foo"))', { + sanitizer: (value, tag, attribute) => value, + }) + ``` + +### Patch Changes + +- 553a175: Replace RuleType enum with an object + ## 7.4.7 ### Patch Changes diff --git a/package.json b/package.json index 337791c6..e4f34f5b 100644 --- a/package.json +++ b/package.json @@ -3,7 +3,7 @@ "description": "Convert markdown to JSX with ease for React and React-like projects. Super lightweight and highly configurable.", "homepage": "https://markdown-to-jsx.quantizor.dev", "license": "MIT", - "version": "7.4.7", + "version": "7.5.0", "publishConfig": { "access": "public" },