apostrophecms
diff --git a/‎.changeset/sixty-hats-kneel.md‎
Lines changed: 5 additions & 0 deletions b/‎.changeset/sixty-hats-kneel.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎packages/sanitize-html/index.js‎
Lines changed: 1 addition & 1 deletion b/‎packages/sanitize-html/index.js‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/sanitize-html/test/test.js‎
Lines changed: 12 additions & 0 deletions b/‎packages/sanitize-html/test/test.js‎
Lines changed: 12 additions & 0 deletions
@@ -0,0 +1,5 @@
+---
+"apostrophe": patch
+---
+
+Fix invalid HTML output for <col> elements in sanitize-html (treat void elements correctly)
@@ -953,7 +953,7 @@ sanitizeHtml.defaults = {
     'alt'
   ],
   // Lots of these won't come up by default because we don't allow them
-  selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
+  selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta', 'col' ],
   // URL schemes we permit
   allowedSchemes: [ 'http', 'https', 'ftp', 'mailto', 'tel' ],
   allowedSchemesByTag: {},
 
@@ -23,6 +23,18 @@ describe('sanitizeHtml', function() {
   it('should pass through simple, well-formed markup', function() {
     assert.equal(sanitizeHtml('<div><p>Hello <b>there</b></p></div>'), '<div><p>Hello <b>there</b></p></div>');
   });
+  it('should preserve col as a self closing tag', function() {
+    assert.equal(
+      sanitizeHtml(
+        '<table><colgroup><col span="2"></colgroup></table>',
+        {
+          allowedTags: false,
+          allowedAttributes: false
+        }
+      ),
+      '<table><colgroup><col span="2" /></colgroup></table>'
+    );
+  });
   it('should not pass through any text outside html tag boundary since html tag is found and option is ON', function() {
     assert.equal(sanitizeHtml('Text before html tag<html><div><p>Hello <b>there</b></p></div></html>Text after html tag!P�X��[<p>paragraph after closing html</p>', {
       enforceHtmlBoundary: true
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"apostrophe": patch
 +---
++
 +Fix invalid HTML output for <col> elements in sanitize-html (treat void elements correctly)