1 |
|
2 |
|
3 |
|
4 |
|
5 |
|
6 |
|
7 | var FilterCSS = require("cssfilter").FilterCSS;
|
8 | var DEFAULT = require("./default");
|
9 | var parser = require("./parser");
|
10 | var parseTag = parser.parseTag;
|
11 | var parseAttr = parser.parseAttr;
|
12 | var _ = require("./util");
|
13 |
|
14 |
|
15 |
|
16 |
|
17 |
|
18 |
|
19 |
|
20 | function isNull(obj) {
|
21 | return obj === undefined || obj === null;
|
22 | }
|
23 |
|
24 |
|
25 |
|
26 |
|
27 |
|
28 |
|
29 |
|
30 |
|
31 |
|
32 | function getAttrs(html) {
|
33 | var i = _.spaceIndex(html);
|
34 | if (i === -1) {
|
35 | return {
|
36 | html: "",
|
37 | closing: html[html.length - 2] === "/",
|
38 | };
|
39 | }
|
40 | html = _.trim(html.slice(i + 1, -1));
|
41 | var isClosing = html[html.length - 1] === "/";
|
42 | if (isClosing) html = _.trim(html.slice(0, -1));
|
43 | return {
|
44 | html: html,
|
45 | closing: isClosing,
|
46 | };
|
47 | }
|
48 |
|
49 |
|
50 |
|
51 |
|
52 |
|
53 |
|
54 |
|
55 | function shallowCopyObject(obj) {
|
56 | var ret = {};
|
57 | for (var i in obj) {
|
58 | ret[i] = obj[i];
|
59 | }
|
60 | return ret;
|
61 | }
|
62 |
|
63 | function keysToLowerCase(obj) {
|
64 | var ret = {};
|
65 | for (var i in obj) {
|
66 | if (Array.isArray(obj[i])) {
|
67 | ret[i.toLowerCase()] = obj[i].map(function (item) {
|
68 | return item.toLowerCase();
|
69 | });
|
70 | } else {
|
71 | ret[i.toLowerCase()] = obj[i];
|
72 | }
|
73 | }
|
74 | return ret;
|
75 | }
|
76 |
|
77 |
|
78 |
|
79 |
|
80 |
|
81 |
|
82 |
|
83 |
|
84 |
|
85 |
|
86 | function FilterXSS(options) {
|
87 | options = shallowCopyObject(options || {});
|
88 |
|
89 | if (options.stripIgnoreTag) {
|
90 | if (options.onIgnoreTag) {
|
91 | console.error(
|
92 | 'Notes: cannot use these two options "stripIgnoreTag" and "onIgnoreTag" at the same time'
|
93 | );
|
94 | }
|
95 | options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
|
96 | }
|
97 | if (options.whiteList || options.allowList) {
|
98 | options.whiteList = keysToLowerCase(options.whiteList || options.allowList);
|
99 | } else {
|
100 | options.whiteList = DEFAULT.whiteList;
|
101 | }
|
102 |
|
103 | options.onTag = options.onTag || DEFAULT.onTag;
|
104 | options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
|
105 | options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;
|
106 | options.onIgnoreTagAttr = options.onIgnoreTagAttr || DEFAULT.onIgnoreTagAttr;
|
107 | options.safeAttrValue = options.safeAttrValue || DEFAULT.safeAttrValue;
|
108 | options.escapeHtml = options.escapeHtml || DEFAULT.escapeHtml;
|
109 | this.options = options;
|
110 |
|
111 | if (options.css === false) {
|
112 | this.cssFilter = false;
|
113 | } else {
|
114 | options.css = options.css || {};
|
115 | this.cssFilter = new FilterCSS(options.css);
|
116 | }
|
117 | }
|
118 |
|
119 |
|
120 |
|
121 |
|
122 |
|
123 |
|
124 |
|
125 | FilterXSS.prototype.process = function (html) {
|
126 |
|
127 | html = html || "";
|
128 | html = html.toString();
|
129 | if (!html) return "";
|
130 |
|
131 | var me = this;
|
132 | var options = me.options;
|
133 | var whiteList = options.whiteList;
|
134 | var onTag = options.onTag;
|
135 | var onIgnoreTag = options.onIgnoreTag;
|
136 | var onTagAttr = options.onTagAttr;
|
137 | var onIgnoreTagAttr = options.onIgnoreTagAttr;
|
138 | var safeAttrValue = options.safeAttrValue;
|
139 | var escapeHtml = options.escapeHtml;
|
140 | var cssFilter = me.cssFilter;
|
141 |
|
142 |
|
143 | if (options.stripBlankChar) {
|
144 | html = DEFAULT.stripBlankChar(html);
|
145 | }
|
146 |
|
147 |
|
148 | if (!options.allowCommentTag) {
|
149 | html = DEFAULT.stripCommentTag(html);
|
150 | }
|
151 |
|
152 |
|
153 | var stripIgnoreTagBody = false;
|
154 | if (options.stripIgnoreTagBody) {
|
155 | stripIgnoreTagBody = DEFAULT.StripTagBody(
|
156 | options.stripIgnoreTagBody,
|
157 | onIgnoreTag
|
158 | );
|
159 | onIgnoreTag = stripIgnoreTagBody.onIgnoreTag;
|
160 | }
|
161 |
|
162 | var retHtml = parseTag(
|
163 | html,
|
164 | function (sourcePosition, position, tag, html, isClosing) {
|
165 | var info = {
|
166 | sourcePosition: sourcePosition,
|
167 | position: position,
|
168 | isClosing: isClosing,
|
169 | isWhite: Object.prototype.hasOwnProperty.call(whiteList, tag),
|
170 | };
|
171 |
|
172 |
|
173 | var ret = onTag(tag, html, info);
|
174 | if (!isNull(ret)) return ret;
|
175 |
|
176 | if (info.isWhite) {
|
177 | if (info.isClosing) {
|
178 | return "</" + tag + ">";
|
179 | }
|
180 |
|
181 | var attrs = getAttrs(html);
|
182 | var whiteAttrList = whiteList[tag];
|
183 | var attrsHtml = parseAttr(attrs.html, function (name, value) {
|
184 |
|
185 | var isWhiteAttr = _.indexOf(whiteAttrList, name) !== -1;
|
186 | var ret = onTagAttr(tag, name, value, isWhiteAttr);
|
187 | if (!isNull(ret)) return ret;
|
188 |
|
189 | if (isWhiteAttr) {
|
190 |
|
191 | value = safeAttrValue(tag, name, value, cssFilter);
|
192 | if (value) {
|
193 | return name + '="' + value + '"';
|
194 | } else {
|
195 | return name;
|
196 | }
|
197 | } else {
|
198 |
|
199 | ret = onIgnoreTagAttr(tag, name, value, isWhiteAttr);
|
200 | if (!isNull(ret)) return ret;
|
201 | return;
|
202 | }
|
203 | });
|
204 |
|
205 |
|
206 | html = "<" + tag;
|
207 | if (attrsHtml) html += " " + attrsHtml;
|
208 | if (attrs.closing) html += " /";
|
209 | html += ">";
|
210 | return html;
|
211 | } else {
|
212 |
|
213 | ret = onIgnoreTag(tag, html, info);
|
214 | if (!isNull(ret)) return ret;
|
215 | return escapeHtml(html);
|
216 | }
|
217 | },
|
218 | escapeHtml
|
219 | );
|
220 |
|
221 |
|
222 | if (stripIgnoreTagBody) {
|
223 | retHtml = stripIgnoreTagBody.remove(retHtml);
|
224 | }
|
225 |
|
226 | return retHtml;
|
227 | };
|
228 |
|
229 | module.exports = FilterXSS;
|