diff --git a/lib/index.js b/lib/index.js index 083f65b..75d3702 100644 --- a/lib/index.js +++ b/lib/index.js @@ -13,10 +13,21 @@ var handlers = require('./handlers') var own = {}.hasOwnProperty +var deprecationWarningIssued = false + // Factory to transform. function factory(tree, options) { var settings = options || {} - var dangerous = settings.allowDangerousHTML + + // Issue a warning if the deprecated tag 'allowDangerousHTML' is used + if (settings.allowDangerousHTML !== undefined && !deprecationWarningIssued) { + deprecationWarningIssued = true + console.warn( + 'mdast-util-to-hast: deprecation: `allowDangerousHTML` is nonstandard, use `allowDangerousHtml` instead' + ) + } + + var dangerous = settings.allowDangerousHtml || settings.allowDangerousHTML var footnoteById = {} h.dangerous = dangerous diff --git a/readme.md b/readme.md index 6ccd7c5..2b50bfc 100644 --- a/readme.md +++ b/readme.md @@ -63,7 +63,7 @@ Transform the given [mdast][] [tree][] to a [hast][] [tree][]. ##### Options -###### `options.allowDangerousHTML` +###### `options.allowDangerousHtml` Whether to allow [`html`][mdast-html] nodes and inject them as raw HTML (`boolean`, default: `false`). @@ -100,7 +100,7 @@ Default behavior: * [`yaml`][mdast-yaml] and `toml` nodes are ignored (created by [`remark-frontmatter`][remark-frontmatter]) -* [`html`][mdast-html] nodes are ignored if `allowDangerousHTML` is `false` +* [`html`][mdast-html] nodes are ignored if `allowDangerousHtml` is `false` * [`position`][position]s are properly patched * [`node.data.hName`][hname] configures the hast element’s tag-name * [`node.data.hProperties`][hproperties] is mixed into the hast element’s @@ -217,7 +217,7 @@ Yields, in [hast][] (**note**: the `pre` and `language-js` class are normal Use of `mdast-util-to-hast` can open you up to a [cross-site scripting (XSS)][xss] attack. Embedded hast properties (`hName`, `hProperties`, `hChildren`), custom handlers, -and the `allowDangerousHTML` option all provide openings. +and the `allowDangerousHtml` option all provide openings. The following example shows how a script is injected where a benign code block is expected with embedded hast properties: @@ -263,7 +263,7 @@ Yields: