fix(sanitize-html): apply allowedSchemesByTag to srcset URLs (#5576)

Author: spokodev

.changeset/sanitize-html-srcset-allowed-schemes-by-tag.md

@@ -0,0 +1,5 @@
+---
+"sanitize-html": patch
+---
+
+`allowedSchemesByTag` is now applied to `srcset` and `imagesrcset` URLs. Previously the per-tag lookup used the attribute name instead of the tag name, so these attributes always fell back to the global `allowedSchemes` and ignored a tag-specific scheme allowlist.

packages/sanitize-html/index.js

@@ -478,7 +478,7 @@ function sanitizeHtml(html, options, _recursing) {
               try {
                 let parsed = parseSrcset(value);
                 parsed.forEach(function(value) {
-                  if (naughtyHref(a, value.url)) {
+                  if (naughtyHref(name, value.url)) {
                     value.evil = true;
                   }
                 });

packages/sanitize-html/test/test.js

@@ -1025,6 +1025,17 @@ describe('sanitizeHtml', function() {
       '<img src="fallback.jpg" srcset="/upload/f_auto,q_auto:eco,c_fit,w_1460,h_2191/abc.jpg 1460w, /upload/f_auto,q_auto:eco,c_fit,w_1360,h_2041/abc.jpg" />'
     );
   });
+  it('should apply allowedSchemesByTag restrictions to srcset URLs', function() {
+    assert.equal(
+      sanitizeHtml('<img src="https://example.com/fallback.jpg" srcset="https://example.com/foo.jpg 100w" />', {
+        allowedTags: sanitizeHtml.defaults.allowedTags.concat([ 'img' ]),
+        allowedAttributes: { img: [ 'src', 'srcset' ] },
+        allowedSchemes: [ 'http', 'https' ],
+        allowedSchemesByTag: { img: [] }
+      }),
+      '<img />'
+    );
+  });
   it('should drop javascript: in form action', function() {
     assert.equal(
       sanitizeHtml('<form action="javascript:alert(1)"><button>x</button></form>', {