sanitize-html img

[fila90]

PLEASE NOTE: make sure the bug exists in the latest patch level of the project. For instance, if you are running a 2.x version of Apostrophe, you should use the latest in that major version to confirm the bug.

To Reproduce

Step by step instructions to reproduce the behavior:

latest version of sanitize-html does not sanitise img tags same as 2.17.5

expect(sanitizeHtml("<img src="https://dodgy-site.xxx/nsfw.jpeg"/>")).toEqual('')

Expected behavior

to behave same as sanitize-html@2.17.5 and convert <img src="https://dodgy-site.xxx/nsfw.jpeg"/> to ""

Describe the bug

sanitize-html@2.17.6 does not sanitise img tags, it coverts <img src="https://dodgy-site.xxx/nsfw.jpeg"/> to <img src=\"https://dodgy-site.xxx/nsfw.jpeg\"/>

Details

Version of Node.js:
PLEASE NOTE: Only stable LTS versions (20.x, 22.x, 24.x as of 2026-02-24) are fully supported but we will do our best with newer versions. Avoid odd-numbered versions, which are not considered stable.
24.18

Server Operating System:
The server (which might be your dev laptop) on which Apostrophe is running. Linux? MacOS X? Windows? Is Docker involved?
MacOS

Additional context:

Add any other context about the problem here. If the problem is specific to a browser, OS or mobile device, specify which.

Screenshots
If applicable, add screenshots to help explain your problem.

[boutell]

I am unable to reproduce this. See this branch adding a test written exactly as you specified:

#5533

The test passes.

If you believe I am mistaken, please submit a PR with a failing test.

[fila90]

I am unable to reproduce this. See this branch adding a test written exactly as you specified:

#5533

The test passes.

If you believe I am mistaken, please submit a PR with a failing test.

Indeed it passes

what we actually have in our test is

      const html = `
        <iframe src="https://dodgy-site.xxx"/>
        <img src="https://dodgy-site.xxx/nsfw.jpeg"/>
      `;

i just assumed it was <img /> that was causing the bug, my apologies for not testing it thoroughly before submitting the bug

previous version would sanitise this to '' but now it's <img src=\"https://dodgy-site.xxx/nsfw.jpeg\"/> for some reason 😕

i'll just split these in separate tests and should be good, thanks 🙏