diff --git a/CHANGELOG.md b/CHANGELOG.md index 08ddd35..ff43263 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## 2.7.0 (2022-01-25) + +- Allows a more sensible set of default attributes on `` tags. + ## 2.6.1 (2021-12-08) - Fixes style filtering to retain `!important` when used. diff --git a/README.md b/README.md index 414984a..d949bf4 100644 --- a/README.md +++ b/README.md @@ -128,10 +128,9 @@ allowedTags: [ disallowedTagsMode: 'discard', allowedAttributes: { a: [ 'href', 'name', 'target' ], - // We don't currently allow img itself by default, but this - // would make sense if we did. You could add srcset here, - // and if you do the URL is checked for safety - img: [ 'src' ] + // We don't currently allow img itself by default, but + // these attributes would make sense if we did. + img: [ 'src', 'srcset', 'alt', 'title', 'width', 'height', 'loading' ] }, // Lots of these won't come up by default because we don't allow them selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ], diff --git a/index.js b/index.js index 648ec1b..8b21565 100644 --- a/index.js +++ b/index.js @@ -780,10 +780,9 @@ sanitizeHtml.defaults = { disallowedTagsMode: 'discard', allowedAttributes: { a: [ 'href', 'name', 'target' ], - // We don't currently allow img itself by default, but this - // would make sense if we did. You could add srcset here, - // and if you do the URL is checked for safety - img: [ 'src' ] + // We don't currently allow img itself by default, but + // these attributes would make sense if we did. + img: [ 'src', 'srcset', 'alt', 'title', 'width', 'height', 'loading' ] }, // Lots of these won't come up by default because we don't allow them selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],