Merge remote-tracking branch 'github/master' into metascraper

Author: appinteractive

server/hooks/create-excerpt.js

@@ -1,9 +1,14 @@
 /* eslint-disable */
-
 // https://github.com/yangsibai/node-html-excerpt
 // const excerpt = require('html-excerpt');
+
+const sanitizeHtml = require('sanitize-html');
 const trunc = require('trunc-html');
 
+const sanitizeOptions = {
+  allowedTags: [ 'br' ]
+};
+
 module.exports = function (options = {}) { // eslint-disable-line no-unused-vars
   return function (hook) {
 
@@ -15,11 +20,10 @@ module.exports = function (options = {}) { // eslint-disable-line no-unused-vars
 
     try {
       /* eslint no-use-before-define: 0 */  // --> OFF
-      const content = hook.data[options.field]
-      .replace(/\<br\>|\<\/br\>|\<\/ br\>|\<br\>|\<br\\\>|\<p\>|\<\/p\>/ig, "\n")
-      .replace(/\<(strong|b|i|blockquote|pre|em|u|h[1-6]|a)>|\<\/(strong|b|i|blockquote|pre|em|u|h[1-6]|a)>/ig, '')
+      const content = sanitizeHtml(hook.data[options.field], sanitizeOptions)
+      .replace(/\<br\>|\<\/br\>|\<\/ br\>|\<br\>|\<br\\\>/ig, "\n")
       .replace(/\<p\>\<br\>\<\/p\>/ig, ' ')
-      .replace(/(\ )[2,]/ig, ' ')
+      .replace(/(\ ){2,}/ig, ' ')
       .trim();
       hook.data[`${options.field}Excerpt`] = trunc(content, options.length, {
         ignoreTags: ['img', 'script', 'iframe']
@@ -32,7 +36,7 @@ module.exports = function (options = {}) { // eslint-disable-line no-unused-vars
       }
     }
     hook.data[options.field] = hook.data[options.field]
-      .replace(/(\ )[2,]/ig, ' ')
+      .replace(/(\ ){2,}/ig, ' ')
 
     return Promise.resolve(hook);
   };

server/hooks/xss.js

@@ -6,7 +6,7 @@ function clean (dirty) {
   // Convert embeds to a-tags
   dirty = embedToAnchor(dirty);
   dirty = sanitizeHtml(dirty, {
-    allowedTags: ['iframe', 'img', 'p', 'br', 'b', 'i', 'em', 'strong', 'a', 'pre', 'ul', 'li', 'ol', 'span'],
+    allowedTags: ['iframe', 'img', 'p', 'br', 'b', 'i', 'em', 'strong', 'a', 'pre', 'ul', 'li', 'ol', 'span', 'blockquote'],
     allowedAttributes: {
       a: ['href', 'class', 'target', 'data-*'],
       img: [ 'src' ],