Additional allow attributes & tags

sanitize_html/CHANGELOG.md

@@ -1,3 +1,14 @@
+## v3.0.2
+* fix(sanitizer): tighten unicodeEscapeReg to require 3+ consecutive \XX sequences
+
+## v3.0.1
+* Preserve and safely sanitize internal CSS
+* Preserve nested CSS with token-level sanitization
+* Mitigate potential ReDoS in regex patterns
+
+## v3.0.0
+* Add secure, high-performance HTML sanitization engine
+
 ## v2.1.0
  * Remove custom HTML rendering logic in favor of logic from `package:html`.
  * Added `topics` to `pubspec.yaml`.

sanitize_html/benchmark/sanitize_benchmark.dart

@@ -0,0 +1,67 @@
+import 'dart:io';
+
+import 'package:sanitize_html/src/sane_html_validator.dart';
+
+final List<String> sampleHtmlDocuments = [
+  // Short HTML
+  '<p>Hello <strong>world</strong></p>',
+  // Medium HTML
+  '''
+  <div>
+    <p onclick="alert(1)">Click me</p>
+    <img src="javascript:evil()" />
+    <a href="https://example.com" onclick="hack()">link</a>
+  </div>
+  ''',
+  // Large HTML
+  File('benchmark/fixtures/large_email_1.html').readAsStringSync(),
+  File('benchmark/fixtures/large_email_2.html').readAsStringSync(),
+];
+
+void main() {
+  const iterations = 200;
+
+  final sane = SaneHtmlValidator(
+    allowElementId: null,
+    allowClassName: null,
+    addLinkRel: null,
+    allowAttributes: null,
+    allowTags: null,
+  );
+
+  _warmup(sane);
+
+  final saneDuration =
+      _benchmark('SaneHtmlValidator', sane.sanitize, iterations);
+
+  final saneMs = saneDuration.inMilliseconds;
+
+  print('--- Benchmark result ---');
+  print('SaneHtmlValidator  : $saneMs ms');
+}
+
+void _warmup(
+  SaneHtmlValidator sane,
+) {
+  for (final html in sampleHtmlDocuments) {
+    sane.sanitize(html);
+  }
+}
+
+Duration _benchmark(
+  String label,
+  String Function(String) sanitize,
+  int iterations,
+) {
+  final sw = Stopwatch()..start();
+
+  for (var i = 0; i < iterations; i++) {
+    for (final html in sampleHtmlDocuments) {
+      sanitize(html);
+    }
+  }
+
+  sw.stop();
+  print('$label finished in ${sw.elapsed.inMilliseconds} ms');
+  return sw.elapsed;
+}