{"action":"created","issue":{"url":"https://api.github.com/repos/cure53/DOMPurify/issues/186","repository_url":"https://api.github.com/repos/cure53/DOMPurify","labels_url":"https://api.github.com/repos/cure53/DOMPurify/issues/186/labels{/name}","comments_url":"https://api.github.com/repos/cure53/DOMPurify/issues/186/comments","events_url":"https://api.github.com/repos/cure53/DOMPurify/issues/186/events","html_url":"https://github.com/cure53/DOMPurify/issues/186","id":189973167,"number":186,"title":"Issue with escaped qutes","user":{"login":"waterplea","id":11832552,"avatar_url":"https://avatars.githubusercontent.com/u/11832552?v=3","gravatar_id":"","url":"https://api.github.com/users/waterplea","html_url":"https://github.com/waterplea","followers_url":"https://api.github.com/users/waterplea/followers","following_url":"https://api.github.com/users/waterplea/following{/other_user}","gists_url":"https://api.github.com/users/waterplea/gists{/gist_id}","starred_url":"https://api.github.com/users/waterplea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/waterplea/subscriptions","organizations_url":"https://api.github.com/users/waterplea/orgs","repos_url":"https://api.github.com/users/waterplea/repos","events_url":"https://api.github.com/users/waterplea/events{/privacy}","received_events_url":"https://api.github.com/users/waterplea/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-17T08:22:37Z","updated_at":"2016-11-17T08:57:00Z","closed_at":null,"body":"Hi there!\r\n\r\nI'm new to using DOMPurify, I'm working on some email app and it has generated content from Word/Outlook. When you style text with highlight, Outlook generates FONT tag with background color style, which is invalid. So I want to replace it with SPAN using a hook like this:\r\n\r\n```\r\nDOMPurify.addHook('beforeSanitizeElements', function(currentNode, data, config) {\r\n    if (currentNode.tagName === 'FONT') {\r\n       //Do the thing\r\n    }\r\n    return updatedNode;\r\n});\r\n```\r\n\r\nHowever I receive this code from the server and I get escaped quotes in the string. And when I pass this string into DOMPurify using sanitize method it turns this:\r\n\r\n`<FONT style=&quot;BACKGROUND-COLOR: #ffff00&quot;>This should be highligted in yellow</FONT>`\r\n\r\nInto this:\r\n\r\n`<font style=\"&quot;BACKGROUND-COLOR:\" #ffff00&quot;=\"\">This should be highligted in yellow</font>`\r\n\r\nWhich breaks style attribute. Although it could be fixed by messing with the string prior to feeding it to DOMPurify, I think it could be a common situation and it would probably be better to fix this in DOMPurify itself, if it should support working with strings.\r\n"},"comment":{"url":"https://api.github.com/repos/cure53/DOMPurify/issues/comments/261190631","html_url":"https://github.com/cure53/DOMPurify/issues/186#issuecomment-261190631","issue_url":"https://api.github.com/repos/cure53/DOMPurify/issues/186","id":261190631,"user":{"login":"cure53","id":6709482,"avatar_url":"https://avatars.githubusercontent.com/u/6709482?v=3","gravatar_id":"","url":"https://api.github.com/users/cure53","html_url":"https://github.com/cure53","followers_url":"https://api.github.com/users/cure53/followers","following_url":"https://api.github.com/users/cure53/following{/other_user}","gists_url":"https://api.github.com/users/cure53/gists{/gist_id}","starred_url":"https://api.github.com/users/cure53/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cure53/subscriptions","organizations_url":"https://api.github.com/users/cure53/orgs","repos_url":"https://api.github.com/users/cure53/repos","events_url":"https://api.github.com/users/cure53/events{/privacy}","received_events_url":"https://api.github.com/users/cure53/received_events","type":"User","site_admin":false},"created_at":"2016-11-17T08:57:00Z","updated_at":"2016-11-17T08:57:00Z","body":"Heya :)\r\n\r\n> it would probably be better to fix this in DOMPurify itself, if it should support working with strings.\r\n\r\nNope, not gonna happen. Ever. If we start fiddling around with the strings we receive before they hit the DOM implementation we sanitize with, we open a can of worms. And likely break existing implementations all over the place.\r\n\r\n> I noticed that neither beforeSanitizeElements, nor afterSanitizeElements cannot change the actual element tag\r\n\r\nOf course you can - that's what the hooks are there for :D I can however not help solve this problem before having seen the code. Let me know how your code looks like and I can help."}}
{"actor":{"display_login":"cure53"}}