leizongmin/js-xss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added tel number handling for links

Browse Source
This commit is contained in:
Christian Schoeppler
2017-11-24 13:57:30 +01:00
parent 7bfd985575
commit 2728bb88f7
4 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
dist/xss.js vendored
View File

@@ -159,6 +159,7 @@ function safeAttrValue (tag, name, value, cssFilter) {
if (!(value.substr(0, 7) === 'http://' || if (!(value.substr(0, 7) === 'http://' ||
value.substr(0, 8) === 'https://' || value.substr(0, 8) === 'https://' ||
value.substr(0, 7) === 'mailto:' || value.substr(0, 7) === 'mailto:' ||
value.substr(0, 4) === 'tel:' ||
value[0] === '#' || value[0] === '#' ||
value[0] === '/')) { value[0] === '/')) {
return ''; return '';

2
dist/xss.min.js vendored
View File

File diff suppressed because one or more lines are too long

1
lib/default.js
View File

@@ -158,6 +158,7 @@ function safeAttrValue (tag, name, value, cssFilter) {
if (!(value.substr(0, 7) === 'http://' || if (!(value.substr(0, 7) === 'http://' ||
value.substr(0, 8) === 'https://' || value.substr(0, 8) === 'https://' ||
value.substr(0, 7) === 'mailto:' || value.substr(0, 7) === 'mailto:' ||
value.substr(0, 4) === 'tel:' ||
value[0] === '#' || value[0] === '#' ||
value[0] === '/')) { value[0] === '/')) {
return ''; return '';

1
test/test_xss.js
View File

@@ -209,6 +209,7 @@ describe('test XSS', function () {
assert.equal(xss('<a href="http://aa.com">'), '<a href="http://aa.com">'); assert.equal(xss('<a href="http://aa.com">'), '<a href="http://aa.com">');
assert.equal(xss('<a href="https://aa.com">'), '<a href="https://aa.com">'); assert.equal(xss('<a href="https://aa.com">'), '<a href="https://aa.com">');
assert.equal(xss('<a href="mailto:me@ucdok.com">'), '<a href="mailto:me@ucdok.com">'); assert.equal(xss('<a href="mailto:me@ucdok.com">'), '<a href="mailto:me@ucdok.com">');
assert.equal(xss('<a href="tel:0123456789">'), '<a href="tel:0123456789">');
assert.equal(xss('<a href="#hello">'), '<a href="#hello">'); assert.equal(xss('<a href="#hello">'), '<a href="#hello">');
assert.equal(xss('<a href="other">'), '<a href>'); assert.equal(xss('<a href="other">'), '<a href>');