leizongmin/js-xss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

过滤 data URI 协议

Browse Source
This commit is contained in:
Zongmin Lei
2013-12-24 13:38:57 +08:00
parent 08763df2c7
commit 54699f2da1
2 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/index.js
View File

@@ -60,6 +60,8 @@ var REGEXP_DEFAULT_ON_TAG_ATTR_1 = /\/\*|\*\//mg;
var REGEXP_DEFAULT_ON_TAG_ATTR_2 = /^[\s"'`]*((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a)\:/ig;
var REGEXP_DEFAULT_ON_TAG_ATTR_3 = /\/\*|\*\//mg;
var REGEXP_DEFAULT_ON_TAG_ATTR_4 = /((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a)\:/ig;
var REGEXP_DEFAULT_ON_TAG_ATTR_5 = /^[\s"'`]*(d\s*a\s*t\s*a\s*)\:/ig;
var REGEXP_DEFAULT_ON_TAG_ATTR_6 = /^[\s"'`]*(d\s*a\s*t\s*a\s*)\:\s*image\//ig;
/**
@@ -72,19 +74,34 @@ var REGEXP_DEFAULT_ON_TAG_ATTR_4 = /((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c
*/
function defaultOnTagAttr (tag, attr, value) {
if (attr === 'href' || attr === 'src') {
// 过滤 href 和 src 属性
// javascript:
REGEXP_DEFAULT_ON_TAG_ATTR_1.lastIndex = 0;
if (REGEXP_DEFAULT_ON_TAG_ATTR_1.test(value)) {
return '#';
}
// /*注释*/
REGEXP_DEFAULT_ON_TAG_ATTR_2.lastIndex = 0;
if (REGEXP_DEFAULT_ON_TAG_ATTR_2.test(value)) {
return '#';
}
// data:
REGEXP_DEFAULT_ON_TAG_ATTR_5.lastIndex = 0;
if (REGEXP_DEFAULT_ON_TAG_ATTR_5.test(value)) {
// 允许 data: image/* 类型
REGEXP_DEFAULT_ON_TAG_ATTR_6.lastIndex = 0;
if (!REGEXP_DEFAULT_ON_TAG_ATTR_6.test(value)) {
return '#';
}
}
} else if (attr === 'style') {
// 过滤 style 属性 （这个xss漏洞较老了，可能已经不适用）
// javascript:
REGEXP_DEFAULT_ON_TAG_ATTR_3.lastIndex = 0;
if (REGEXP_DEFAULT_ON_TAG_ATTR_3.test(value)) {
return '#';
}
// /*注释*/
REGEXP_DEFAULT_ON_TAG_ATTR_4.lastIndex = 0;
if (REGEXP_DEFAULT_ON_TAG_ATTR_4.test(value)) {
return '';

11
test/test_xss.js
View File

@@ -218,6 +218,17 @@ describe('test XSS', function () {
assert.equal(xss('<a href="a&NewLine;b">'), '<a href="a b">');
assert.equal(xss('<a href="a&NewLineb">'), '<a href="a b">');
assert.equal(xss('<a href="javasc&NewLine;ript&colon;alert(1)">'), '<a href="#">');
// data URI 协议过滤，只允许 data: image/*
assert.equal(xss('<a href="data:">'), '<a href="#">');
assert.equal(xss('<a href="d a t a : ">'), '<a href="#">');
assert.equal(xss('<a href="data: html/text;">'), '<a href="#">');
assert.equal(xss('<a href="data:html/text;">'), '<a href="#">');
assert.equal(xss('<a href="data:html /text;">'), '<a href="#">');
assert.equal(xss('<a href="data: image/text;">'), '<a href="data: image/text;">');
assert.equal(xss('<img src="data: aaa/text;">'), '<img src="#">');
assert.equal(xss('<img src="data:image/png; base64; ofdkofiodiofl">'), '<img src="data:image/png; base64; ofdkofiodiofl">');
});
});