leizongmin/js-xss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed issue #36 safeAttrValue() check if cssFilter argument is undefined then use an default cssFilter

Browse Source
This commit is contained in:
Zongmin Lei
2015-07-30 12:00:08 +08:00
parent 467bfe1c8c
commit b5902962ad
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
lib/default.js
View File

@@ -4,6 +4,7 @@
* @author 老雷<leizongmin@gmail.com> * @author 老雷<leizongmin@gmail.com>
*/ */
var FilterCSS = require('cssfilter').FilterCSS;
var _ = require('./util'); var _ = require('./util');
// 默认白名单 // 默认白名单
@@ -73,6 +74,9 @@ var whiteList = {
video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width'] video: ['autoplay', 'controls', 'loop', 'preload', 'src', 'height', 'width']
}; };
// 默认CSS Filter
var defaultCSSFilter = new FilterCSS();
/** /**
* 匹配到标签时的处理方法 * 匹配到标签时的处理方法
* *
@@ -140,6 +144,7 @@ function escapeHtml (html) {
* @return {String} * @return {String}
*/ */
function safeAttrValue (tag, name, value, cssFilter) { function safeAttrValue (tag, name, value, cssFilter) {
cssFilter = cssFilter || defaultCSSFilter;
// 转换为友好的属性值，再做判断 // 转换为友好的属性值，再做判断
value = friendlyAttrValue(value); value = friendlyAttrValue(value);
@@ -397,3 +402,5 @@ exports.onIgnoreTagStripAll = onIgnoreTagStripAll;
exports.StripTagBody = StripTagBody; exports.StripTagBody = StripTagBody;
exports.stripCommentTag = stripCommentTag; exports.stripCommentTag = stripCommentTag;
exports.stripBlankChar = stripBlankChar; exports.stripBlankChar = stripBlankChar;
exports.cssFilter = defaultCSSFilter;