修正:当启用stripIgnoreTagBody时,如果以要过滤的标签开头,会导致前面部分没正确删除[removed]标记
This commit is contained in:
@@ -302,5 +302,24 @@ describe('test custom XSS method', function () {
|
||||
assert.equal(html, '<a>link</a>$y$a$y$$y$b$y$k');
|
||||
});
|
||||
|
||||
it('#stripIgnoreTag & stripIgnoreTagBody', function () {
|
||||
var source = '<script>alert(/xss/);</script>';
|
||||
var html = xss(source, {
|
||||
stripIgnoreTag: true,
|
||||
stripIgnoreTagBody: ['script']
|
||||
});
|
||||
console.log(html);
|
||||
assert.equal(html, '');
|
||||
});
|
||||
|
||||
it('#stripIgnoreTag & stripIgnoreTagBody - 2', function () {
|
||||
var source = 'ooxx<script>alert(/xss/);</script>';
|
||||
var html = xss(source, {
|
||||
stripIgnoreTag: true,
|
||||
stripIgnoreTagBody: ['script']
|
||||
});
|
||||
console.log(html);
|
||||
assert.equal(html, 'ooxx');
|
||||
});
|
||||
|
||||
});
|
||||
Reference in New Issue
Block a user