104420169

Build # 104420169

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/antvis/x6/commit/<a class=hub.com/antvis/x6/commit/<a class="double-link" href="https://git"><a class=hub.com/antvis/x6/commit/<a class="double-link" href="https://git"><a class=hub.com/antvis/x6/commit/<a class="double-link" href="https://git"><a class=hub.com/antvis/x6/commit/<a class="double-link" href="https://git"><a class=hub.com/antvis/x6/commit/<a class="double-link" href="https://git"><a class=hub.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87">7614c73ae<a href="https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/antvis/x6/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/antvis/x6/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/antvis/x6/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/antvis/x6/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87&quot;&gt;7614c73ae&lt;/a&gt;&lt;a href=&quot;https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87&amp;quot;&amp;gt;&amp;amp;quot;&amp;amp;gt;&amp;amp;amp;lt;a href=&amp;amp;amp;quot;https://github.com/antvis/x6/commit/&amp;amp;lt;/a&amp;amp;gt;&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://github.com/antvis/x6/commit/&amp;amp;amp;lt;a class=&amp;amp;amp;quot;double-link&amp;amp;amp;quot; href=&amp;amp;amp;quot;https://git&amp;amp;quot;&amp;amp;gt;&amp;amp;amp;lt;a class=&amp;amp;lt;/a&amp;amp;gt;hub.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87&amp;amp;quot;&amp;amp;gt;7614c73ae&amp;amp;lt;/a&amp;amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87&amp;amp;quot;&amp;amp;gt;&amp;amp;amp;lt;a href=&amp;amp;amp;quot;https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e&amp;lt;/a&amp;</a>gt;7ca1ee87&quot;&gt;&amp;quot;&amp;gt;Merge &amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/antvis/x6/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/antvis/x6/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/antvis/x6/commit/<a class="double-link" href="https://github.com/antvis/x6/commit/9218991e61441ac3b4876f11e3384bb5f5203d0d">9218991e6</a>&quot;&gt;9218991e6&lt;/a&gt;&lt;a href=&quot;https://github.com/antvis/x6/commit/7614c73aebeafcea190b2eda25034d3e7ca1ee87">&amp;quot... (continued)

Pull Request Pull Request #123: Feat/marker

Run Details

852 of 2658 branches covered (32.05%)

Branch coverage included in aggregate %.

53 of 53 new or added lines in 7 files covered. (100.0%)

2294 of 5077 relevant lines covered (45.18%)

247.53 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

5.88

/packages/x6/src/util/string/html.ts

import $ from 'jquery'

/**
 * Sanitizes HTML with jQuery prevent Application from XSS attacks.
 * ref: https://gist.github.com/ufologist/5a0da51b2b9ef1b861c30254172ac3c9
 */
export function sanitizeHTML(html: string): string
export function sanitizeHTML(html: string, options: { raw: false }): string
export function sanitizeHTML(
  html: string,
  options: { raw: true },
): JQuery.Node[]
export function sanitizeHTML(html: string, options: { raw?: boolean } = {}) {
  // If documentContext (second parameter) is not specified or given as
  // `null` or `undefined`, a new document is used. Inline events will not
  // execute when the HTML is parsed; this includes, for example, sending
  // GET requests for images.

  // If keepScripts (last parameter) is `false`, scripts are not executed.
  const nodes = $.parseHTML(html, null, false)

  nodes.forEach((node) => {
    const elem = node as Element
    if (elem) {
      const attrs = elem.attributes
      if (attrs) {
        for (let i = 0, ii = attrs.length; i < ii; i += 1) {
          const attr = attrs.item(i)
          if (attr) {
            const val = attr.value.toLowerCase()
            const name = attr.name.toLowerCase()

            // Removes attribute name starts with "on" (e.g. onload,
            // onerror...).
            // Removes attribute value starts with "javascript:" pseudo
            // protocol (e.g. `href="javascript:alert(1)"`).
            if (
              name.startsWith('on') ||
              val.startsWith('javascript:') ||
              // ref: https://lgtm.com/rules/1510852698359/
              val.startsWith('data:') ||
              val.startsWith('vbscript:')
            ) {
              elem.removeAttribute(name)
            }
          }
        }
      }
    }
  })

  if (options.raw) {
    return nodes
  }

  return $('<div/>').append(nodes).html()
}

1	import $ from 'jquery'	3✔
2
3	/**
4	* Sanitizes HTML with jQuery prevent Application from XSS attacks.
5	* ref: https://gist.github.com/ufologist/5a0da51b2b9ef1b861c30254172ac3c9
6	*/
7	export function sanitizeHTML(html: string): string
8	export function sanitizeHTML(html: string, options: { raw: false }): string
9	export function sanitizeHTML(
10	html: string,
11	options: { raw: true },
12	): JQuery.Node[]
13	export function sanitizeHTML(html: string, options: { raw?: boolean } = {}) {	3!
14	// If documentContext (second parameter) is not specified or given as
15	// `null` or `undefined`, a new document is used. Inline events will not
16	// execute when the HTML is parsed; this includes, for example, sending
17	// GET requests for images.
18
19	// If keepScripts (last parameter) is `false`, scripts are not executed.
20	const nodes = $.parseHTML(html, null, false)	×
21
22	nodes.forEach((node) => {	×
23	const elem = node as Element	×
24	if (elem) {	×
25	const attrs = elem.attributes	×
26	if (attrs) {	×
27	for (let i = 0, ii = attrs.length; i < ii; i += 1) {	×
28	const attr = attrs.item(i)	×
29	if (attr) {	×
30	const val = attr.value.toLowerCase()	×
31	const name = attr.name.toLowerCase()	×
32
33	// Removes attribute name starts with "on" (e.g. onload,
34	// onerror...).
35	// Removes attribute value starts with "javascript:" pseudo
36	// protocol (e.g. `href="javascript:alert(1)"`).
37	if (	×
38	name.startsWith('on') \|\|	×
39	val.startsWith('javascript:') \|\|
40	// ref: https://lgtm.com/rules/1510852698359/
41	val.startsWith('data:') \|\|
42	val.startsWith('vbscript:')
43	) {
44	elem.removeAttribute(name)	×
45	}
46	}
47	}
48	}
49	}
50	})
51
52	if (options.raw) {	×
53	return nodes	×
54	}
55
56	return $('<div/>').append(nodes).html()	×
57	}

antvis / x6 / 104420169

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous