v1.4.0 - Stricter attribute value escaping

This is a critical update if you are using a custom white list with iframe elements allowed. Due to their non-standard parsing within browsers it maybe be possible to craft HTML to bypass sanitization by using an element with an attribute value of a closing iframe tag. Those using the default whitelist are not affected.

https://luarocks.org/modules/leafo/web_sanitize

• Make attribute escaping more strict:
  • Approved attributes passed through will now always have < and > characters in the value replaced with < and &gt
  • Injected attributes (attributes that are added despite not previously being there): The value will be escaped as HTML text to ensure invalid markup can't be returned by the injection function/literal
  • Injected attribute names will throw an error if using invalid characters (like < or >)
  • Note: Modified attributes will continue to function the same: the value provided is escaped as HTML text, (escaping < >, &, etc.)

Full Changelog: v1.3.0...v1.4.0