-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
octospacc
committed
Jan 27, 2024
1 parent
9acf326
commit 5730543
Showing
5 changed files
with
112 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| /** | ||
| * Sanitize an HTML string | ||
| * (c) Chris Ferdinandi, MIT License, https://gomakethings.com | ||
| * @param {String} str The HTML string to sanitize | ||
| * @param {Boolean} nodes If true, returns HTML nodes instead of a string | ||
| * @return {String|NodeList} The sanitized string or nodes | ||
| */ | ||
| function cleanHTML (str, nodes) { | ||
|
|
||
| /** | ||
| * Convert the string to an HTML document | ||
| * @return {Node} An HTML document | ||
| */ | ||
| function stringToHTML () { | ||
| let parser = new DOMParser(); | ||
| let doc = parser.parseFromString(str, 'text/html'); | ||
| return doc.body || document.createElement('body'); | ||
| } | ||
|
|
||
| /** | ||
| * Remove <script> elements | ||
| * @param {Node} html The HTML | ||
| */ | ||
| function removeScripts (html) { | ||
| let scripts = html.querySelectorAll('script'); | ||
| for (let script of scripts) { | ||
| script.remove(); | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Check if the attribute is potentially dangerous | ||
| * @param {String} name The attribute name | ||
| * @param {String} value The attribute value | ||
| * @return {Boolean} If true, the attribute is potentially dangerous | ||
| */ | ||
| function isPossiblyDangerous (name, value) { | ||
| let val = value.replace(/\s+/g, '').toLowerCase(); | ||
| if (['src', 'href', 'xlink:href'].includes(name)) { | ||
| if (val.includes('javascript:') || val.includes('data:')) return true; | ||
| } | ||
| if (name.startsWith('on')) return true; | ||
| } | ||
|
|
||
| /** | ||
| * Remove potentially dangerous attributes from an element | ||
| * @param {Node} elem The element | ||
| */ | ||
| function removeAttributes (elem) { | ||
|
|
||
| // Loop through each attribute | ||
| // If it's dangerous, remove it | ||
| let atts = elem.attributes; | ||
| for (let {name, value} of atts) { | ||
| if (!isPossiblyDangerous(name, value)) continue; | ||
| elem.removeAttribute(name); | ||
| } | ||
|
|
||
| } | ||
|
|
||
| /** | ||
| * Remove dangerous stuff from the HTML document's nodes | ||
| * @param {Node} html The HTML document | ||
| */ | ||
| function clean (html) { | ||
| let nodes = html.children; | ||
| for (let node of nodes) { | ||
| removeAttributes(node); | ||
| clean(node); | ||
| } | ||
| } | ||
|
|
||
| // Convert the string to HTML | ||
| let html = stringToHTML(); | ||
|
|
||
| // Sanitize it | ||
| removeScripts(html); | ||
| clean(html); | ||
|
|
||
| // If the user wants HTML nodes back, return them | ||
| // Otherwise, pass a sanitized string back | ||
| return nodes ? html.childNodes : html.innerHTML; | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters