diff --git a/lib/default.js b/lib/default.js index 6495a99..3fb0ca3 100644 --- a/lib/default.js +++ b/lib/default.js @@ -159,6 +159,15 @@ function escapeHtml(html) { return html.replace(REGEXP_LT, "<").replace(REGEXP_GT, ">"); } +/** + * default escapeHtml function but dont escape comment + * + * @param {String} html + */ +function escapeHtmlNotComment(html) { + return html.replace(REGEXP_LT_NOT_COMMENT, "<").replace(REGEXP_RT_NOT_COMMENT, ">"); +} + /** * default safeAttrValue function * @@ -228,6 +237,8 @@ function safeAttrValue(tag, name, value, cssFilter) { // RegExp list var REGEXP_LT = //g; +var REGEXP_LT_NOT_COMMENT = /<(?!!--)/g; +var REGEXP_RT_NOT_COMMENT = /(? END", { allowCommentTag: true } ), - "<!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]--> END" + " END" ); assert.equal( xss(