var xss = require('xss');
var videoUrlInspector = require('democracyos-video-url-inspector');

module.exports = function xssFilter (opts) {
  var defaults = {
    fontFace: false,
    fontSize: false,
    fontWidth: true,
    image: true,
    video: true,
    link: true,
    bullet: true,
    list: true
  };

  var empty = [];
  var whiteList = {
    div: [ 'style', 'class' ],
    span: [ 'style' ],
    br: empty,
    b: empty,
    i: empty,
    u: empty,
    ul: empty,
    ol: empty,
    li: empty
  };

  if (opts.image) whiteList.img = [ 'src' ];
  if (opts.video) whiteList.iframe = [ 'src' ];
  if (opts.link) whiteList.a = [ 'href' ];

  var filter = new xss.FilterXSS({
    whiteList: whiteList,

    css: {
      whiteList: {
        color: true,
        'text-align': true,
        'background-color': true,
      }
    },

    safeAttrValue: function(tag, name, value, cssFilter) {
      value = xss.safeAttrValue(tag, name, value, cssFilter);

      // Remove protocol from srcs, to force https when needed
      if ('src' === name && 'string' === typeof value) {
        value = value.replace(/^https?:\/\//, '//');
      }

      // Parse iframe's to only allow video embeds
      if ('iframe' === tag && 'src' === name) {
        var video = videoUrlInspector(value);
        value = video ? video.embedUrl : '';
      }

      return value;
    }
  });

  return filter.process.bind(filter);
};

@@ -19,16 +19,66 @@
 'xss');%0A
+var deepMixIn = require('mout/object/deepMixIn');%0A
 var vide
@@ -138,16 +138,17 @@
 tor');%0A%0A
+%0A
 module.e
@@ -355,16 +355,60 @@
 e%0A  %7D;%0A%0A
+  var options = deepMixIn(defaults, opts);%0A%0A
   var em
@@ -607,16 +607,19 @@
  if (opt
+ion
 s.image)
@@ -655,16 +655,19 @@
  if (opt
+ion
 s.video)
@@ -706,16 +706,19 @@
  if (opt
+ion
 s.link) 

fix xss-filter defaults