Allow width, height, and valign attributes on img tags

lib/sanitize.js

@@ -44,7 +44,7 @@ sanitizer.config = {
     h5: ['id'],
     h6: ['id'],
     a: ['href', 'id', 'name', 'target'],
-    img: ['id', 'src'],
+    img: ['id', 'src', 'width', 'height', 'valign'],
     meta: ['name', 'content'],
     iframe: ['src', 'frameborder', 'allowfullscreen'],
     div: [],

test/fixtures/dirty.md

@@ -12,7 +12,7 @@
 
 <script charset="utf-8" src="http://malware.com" type="text/javascript">alert("haxorz")</script>
 
-<img src="local.png"></img>
+<img src="local.png" width="600" height="400" valign="middle" onclick="maliciousClickHandler()"></img>
 
 <a class="xxx" href="http://yyy.com">zzz</a>
 

test/index.js

@@ -107,6 +107,10 @@ describe('sanitize', function () {
 
   it('allows img tags', function () {
     assert($('img').length)
+    assert.equal($('img').attr('width'), "600")
+    assert.equal($('img').attr('height'), "400")
+    assert.equal($('img').attr('valign'), "middle")
+    assert.equal($('img').attr('onclick'), undefined)
   })
 
   it('allows h1/h2/h3/h4/h5/h6 tags to preserve their dom id', function () {