/** * 测试XSS 自定义处理函数 */ var assert = require('assert'); var xss = require('../'); describe('test custom XSS method', function () { it('#onTag - match tag', function () { var source = 'ddhaha
ff'; var i = 0; var html = xss(source, { onTag: function (tag, html, options) { console.log(arguments); i++; if (i === 1) { assert.equal(tag, 'a'); assert.equal(html, ''); assert.equal(options.isClosing, false); assert.equal(options.position, 2); assert.equal(options.originPosition, 2); assert.equal(options.isWhite, true); } else if (i === 2) { assert.equal(tag, 'b'); assert.equal(html, ''); assert.equal(options.isClosing, false); assert.equal(options.position, 14); assert.equal(options.originPosition, 14); assert.equal(options.isWhite, true); } else if (i === 3) { assert.equal(tag, 'c'); assert.equal(html, ''); assert.equal(options.isClosing, false); assert.equal(options.position, 17); assert.equal(options.originPosition, 17); assert.equal(options.isWhite, false); } else if (i === 4) { assert.equal(tag, 'c'); assert.equal(html, ''); assert.equal(options.isClosing, true); assert.equal(options.position, 30); assert.equal(options.originPosition, 24); assert.equal(options.isWhite, false); } else if (i === 5) { assert.equal(tag, 'b'); assert.equal(html, ''); assert.equal(options.isClosing, true); assert.equal(options.position, 40); assert.equal(options.originPosition, 28); assert.equal(options.isWhite, true); } else if (i === 6) { assert.equal(tag, 'a'); assert.equal(html, ''); assert.equal(options.isClosing, true); assert.equal(options.position, 44); assert.equal(options.originPosition, 32); assert.equal(options.isWhite, true); } else if (i === 7) { assert.equal(tag, 'br'); assert.equal(html, '
'); assert.equal(options.isClosing, false); assert.equal(options.position, 48); assert.equal(options.originPosition, 36); assert.equal(options.isWhite, true); } else { throw new Error(); } } }); console.log(html); assert.equal(html, 'dd<c>haha</c>
ff'); }); it('#onTag - return new html', function () { var source = 'ddhaha
ff'; var i = 0; var html = xss(source, { onTag: function (tag, html, options) { console.log(html); return html; } }); console.log(html); assert.equal(html, source); }); it('#onIgnoreTag - match tag', function () { var source = 'ddhaha
ff'; var i = 0; var html = xss(source, { onIgnoreTag: function (tag, html, options) { console.log(arguments); i++; if (i === 1) { assert.equal(tag, 'c'); assert.equal(html, ''); assert.equal(options.isClosing, false); assert.equal(options.position, 17); assert.equal(options.originPosition, 17); assert.equal(options.isWhite, false); } else if (i === 2) { assert.equal(tag, 'c'); assert.equal(html, ''); assert.equal(options.isClosing, true); assert.equal(options.position, 30); assert.equal(options.originPosition, 24); assert.equal(options.isWhite, false); } else { throw new Error(); } } }); console.log(html); assert.equal(html, 'dd<c>haha</c>
ff'); }); it('#onIgnoreTag - return new html', function () { var source = 'ddhaha
ff'; var i = 0; var html = xss(source, { onIgnoreTag: function (tag, html, options) { console.log(html); return '[' + (options.isClosing ? '/' : '') + 'removed]'; } }); console.log(html); assert.equal(html, 'dd[removed]haha[/removed]
ff'); }); /* // 自定义过滤属性函数 it('#process attribute value', function () { assert.equal(xss('abc', { onTagAttr: function (tag, attr, value) { if (tag === 'a' && attr === 'href') { if (value.substr(0, 7) === 'ignore:') { return '#'; } } } }), 'abc'); }); // 自定义处理不在白名单中的标签 it('#process ignore tag', function () { // 过滤标签 assert.equal(xss('ookk', { onIgnoreTag: function (tag, html) { return ''; } }), 'ookk'); assert.equal(xss('ookk', { onIgnoreTag: function (tag, html) { return '[removed]'; } }), '[removed]ookk[removed]'); // 检验附加属性 var isClosing = []; var position = []; var originPosition = []; var html = xss('TTG:ds--ds d', { onIgnoreTag: function (tag, html, options) { isClosing.push(options.isClosing); position.push(options.position); originPosition.push(options.originPosition); } }); //console.log(html); assert.deepEqual(isClosing, [false, true, false]); assert.deepEqual(position, [4, 30, 50]); assert.deepEqual(originPosition, [4, 24, 38]); // 替换检验 utils.tagFilter() var filter = xss.utils.tagFilter(['script']); var html = xss('script is , wahaha!!', { onIgnoreTag: filter.onIgnoreTag }); assert.equal(filter.filter(html), 'script is , wahaha!!'); var filter = xss.utils.tagFilter(['x2']); var html = xss('ddsfd', { onIgnoreTag: filter.onIgnoreTag }); assert.equal(filter.filter(html), '<x1><x3>fd</x3>'); }); */ });