leizongmin/js-xss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #249 from schu34/ms/add-allowlist-support

Browse Source 
feat: add support for allowList as an alias for whiteList
This commit is contained in:
老雷
2021-12-31 21:05:29 +08:00
committed by GitHub
parent 3826e74155 6914bbaf93
commit daa471e560
5 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -194,6 +194,8 @@ var options = {
For the default whitelist, please refer `xss.whiteList`.
`allowList` is also supported, and has the same function as `whiteList`.
### Customize the handler function for matched tags
By specifying the handler function with `onTag`:

4
dist/xss.js vendored
View File

@@ -857,7 +857,7 @@ function shallowCopyObject(obj) {
* FilterXSS class
*
* @param {Object} options
* whiteList, onTag, onTagAttr, onIgnoreTag,
* whiteList (or allowList), onTag, onTagAttr, onIgnoreTag,
* onIgnoreTagAttr, safeAttrValue, escapeHtml
* stripIgnoreTagBody, allowCommentTag, stripBlankChar
* css{whiteList, onAttr, onIgnoreAttr} `css=false` means don't use `cssfilter`
@@ -874,7 +874,7 @@ function FilterXSS(options) {
options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
}
options.whiteList = options.whiteList || DEFAULT.whiteList;
options.whiteList = options.whiteList || options.allowList || DEFAULT.whiteList;
options.onTag = options.onTag || DEFAULT.onTag;
options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;

2
dist/xss.min.js vendored
View File

File diff suppressed because one or more lines are too long

4
lib/xss.js
View File

@@ -64,7 +64,7 @@ function shallowCopyObject(obj) {
* FilterXSS class
*
* @param {Object} options
* whiteList, onTag, onTagAttr, onIgnoreTag,
* whiteList (or allowList), onTag, onTagAttr, onIgnoreTag,
* onIgnoreTagAttr, safeAttrValue, escapeHtml
* stripIgnoreTagBody, allowCommentTag, stripBlankChar
* css{whiteList, onAttr, onIgnoreAttr} `css=false` means don't use `cssfilter`
@@ -81,7 +81,7 @@ function FilterXSS(options) {
options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
}
options.whiteList = options.whiteList || DEFAULT.whiteList;
options.whiteList = options.whiteList || options.allowList || DEFAULT.whiteList;
options.onTag = options.onTag || DEFAULT.onTag;
options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;

14
test/test_xss.js
View File

@@ -167,6 +167,20 @@ describe("test XSS", function() {
);
});
it("#allowList", ()=>{
// 过滤所有标签
assert.equal(
xss('<a title="xx">bb</a>', { allowList: {} }),
'&lt;a title="xx"&gt;bb&lt;/a&gt;'
);
assert.equal(xss("<hr>", { allowList: {} }), "&lt;hr&gt;");
// 增加白名单标签及属性
assert.equal(
xss('<ooxx yy="ok" cc="no">uu</ooxx>', { allowList: { ooxx: ["yy"] } }),
'<ooxx yy="ok">uu</ooxx>'
);
})
// XSS攻击测试：https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
it("#XSS_Filter_Evasion_Cheat_Sheet", function() {
assert.equal(