2014-02-13 16:46:37 +08:00
|
|
|
|
/**
|
|
|
|
|
|
* 应用实例：允许标签以data-开头的属性
|
|
|
|
|
|
*
|
2017-12-21 14:19:10 +08:00
|
|
|
|
* @author Zongmin Lei<leizongmin@gmail.com>
|
2014-02-13 16:46:37 +08:00
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
var xss = require('../');
|
|
|
|
|
|
|
|
|
|
|
|
var source = '<div a="1" b="2" data-a="3" data-b="4">hello</div>';
|
|
|
|
|
|
var html = xss(source, {
|
|
|
|
|
|
onIgnoreTagAttr: function (tag, name, value, isWhiteAttr) {
|
|
|
|
|
|
if (name.substr(0, 5) === 'data-') {
|
|
|
|
|
|
// 通过内置的escapeAttrValue函数来对属性值进行转义
|
|
|
|
|
|
return name + '="' + xss.escapeAttrValue(value) + '"';
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
|
|
console.log('%s\nconvert to:\n%s', source, html);
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
|
运行结果：
|
|
|
|
|
|
<div a="1" b="2" data-a="3" data-b="4">hello</div>
|
|
|
|
|
|
convert to:
|
|
|
|
|
|
<div data-a="3" data-b="4">hello</div>
|
|
|
|
|
|
*/
|
