diff --git a/index.js b/index.js index 8515483..8b21565 100644 --- a/index.js +++ b/index.js @@ -780,10 +780,9 @@ sanitizeHtml.defaults = { disallowedTagsMode: 'discard', allowedAttributes: { a: [ 'href', 'name', 'target' ], - // We don't currently allow img itself by default, but these - // would make sense if we did. You could add srcset here, - // and if you do the URL is checked for safety - img: [ 'src', 'alt', 'title', 'width', 'height', 'loading' ] + // We don't currently allow img itself by default, but + // these attributes would make sense if we did. + img: [ 'src', 'srcset', 'alt', 'title', 'width', 'height', 'loading' ] }, // Lots of these won't come up by default because we don't allow them selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],