leizongmin / js-xss / #63

pending completion

Build # #63

Build Type

push

travis-pro

Committed by

web-flow

Commit Message

<a href="https://github.com/leizongmin/js-xss/commit/<a class=hub.com/leizongmin/js-xss/commit/<a class="double-link" href="https://git"><a class=hub.com/leizongmin/js-xss/commit/<a class="double-link" href="https://git"><a class=hub.com/leizongmin/js-xss/commit/<a class="double-link" href="https://git"><a class=hub.com/leizongmin/js-xss/commit/<a class="double-link" href="https://git"><a class=hub.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44">b7cfad980">&lt;a href=&quot;https://github.com/leizongmin/js-xss/commit/</a><a class="double-link" href="https://github.com/leizongmin/js-xss/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/leizongmin/js-xss/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/leizongmin/js-xss/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44">b7cfad980</a><a href="https://github.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44">&lt;a href=&quot;https://github.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/leizongmin/js-xss/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/leizongmin/js-xss/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot;&amp;gt;&amp;amp;lt;a class=&amp;lt;/a&amp;gt;hub.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44&amp;quot;&amp;gt;b7cfad980&amp;lt;/a&amp;gt;&amp;lt;a href=&amp;quot;https://github.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b856633f44&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/leizongmin/js-xss/commit/b7cfad98019cae123e41937d250706b8&amp;lt;/a&amp;gt;56633</a>f44&quot;&gt;&amp;quot;&amp;gt;Merge &amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/leizongmin/js-xss/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/leizongmin/js-xss/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/leizongmin/js-xss/commit/5f0eaf819&quot;&gt;5f0eaf8... (continued)

Run Details

207 of 226 branches covered (91.59%)

9 of 9 new or added lines in 1 file covered. (100.0%)

365 of 379 relevant lines covered (96.31%)

169.68 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

96.23

/lib/parser.js

/**
 * Simple HTML Parser
 *
 * @author Zongmin Lei<leizongmin@gmail.com>
 */

var _ = require("./util");

/**
 * get tag name
 *
 * @param {String} html e.g. '<a hef="#">'
 * @return {String}
 */
function getTagName(html) {
  let i = _.spaceIndex(html);
  let tagName;
  if (i === -1) {
    tagName = html.slice(1, -1);
  } else {
    tagName = html.slice(1, i + 1);
  }
  tagName = _.trim(tagName).toLowerCase();
  if (tagName.slice(0, 1) === "/") tagName = tagName.slice(1);
  if (tagName.slice(-1) === "/") tagName = tagName.slice(0, -1);
  return tagName;
}

/**
 * is close tag?
 *
 * @param {String} html 如：'<a hef="#">'
 * @return {Boolean}
 */
function isClosing(html) {
  return html.slice(0, 2) === "</";
}

/**
 * parse input html and returns processed html
 *
 * @param {String} html
 * @param {Function} onTag e.g. function (sourcePosition, position, tag, html, isClosing)
 * @param {Function} escapeHtml
 * @return {String}
 */
function parseTag(html, onTag, escapeHtml) {
  "use strict";

  var rethtml = "";
  var lastPos = 0;
  var tagStart = false;
  var quoteStart = false;
  var currentPos = 0;
  var len = html.length;
  var currentTagName = "";
  var currentHtml = "";

  chariterator: for (currentPos = 0; currentPos < len; currentPos++) {
    var c = html.charAt(currentPos);
    if (tagStart === false) {
      if (c === "<") {
        tagStart = currentPos;
        continue;
      }
    } else {
      if (quoteStart === false) {
        if (c === "<") {
          rethtml += escapeHtml(html.slice(lastPos, currentPos));
          tagStart = currentPos;
          lastPos = currentPos;
          continue;
        }
        if (c === ">") {
          rethtml += escapeHtml(html.slice(lastPos, tagStart));
          currentHtml = html.slice(tagStart, currentPos + 1);
          currentTagName = getTagName(currentHtml);
          rethtml += onTag(
            tagStart,
            rethtml.length,
            currentTagName,
            currentHtml,
            isClosing(currentHtml)
          );
          lastPos = currentPos + 1;
          tagStart = false;
          continue;
        }
        if (c === '"' || c === "'") {
          var i = 1;
          var ic = html.charAt(currentPos - i);

          while (ic.trim() === "" || ic === "=") {
            if (ic === "=") {
              quoteStart = c;
              continue chariterator;
            }
            ic = html.charAt(currentPos - ++i);
          }
        }
      } else {
        if (c === quoteStart) {
          quoteStart = false;
          continue;
        }
      }
    }
  }
  if (lastPos < html.length) {
    rethtml += escapeHtml(html.substr(lastPos));
  }

  return rethtml;
}

var REGEXP_ILLEGAL_ATTR_NAME = /[^a-zA-Z0-9\\_:.-]/gim;

/**
 * parse input attributes and returns processed attributes
 *
 * @param {String} html e.g. `href="#" target="_blank"`
 * @param {Function} onAttr e.g. `function (name, value)`
 * @return {String}
 */
function parseAttr(html, onAttr) {
  "use strict";

  var lastPos = 0;
  var lastMarkPos = 0;
  var retAttrs = [];
  var tmpName = false;
  var len = html.length;

  function addAttr(name, value) {
    name = _.trim(name);
    name = name.replace(REGEXP_ILLEGAL_ATTR_NAME, "").toLowerCase();
    if (name.length < 1) return;
    var ret = onAttr(name, value || "");
    if (ret) retAttrs.push(ret);
  }

  // 逐个分析字符
  for (var i = 0; i < len; i++) {
    var c = html.charAt(i);
    var v, j;
    if (tmpName === false && c === "=") {
      tmpName = html.slice(lastPos, i);
      lastPos = i + 1;
      lastMarkPos = html.charAt(lastPos) === '"' || html.charAt(lastPos) === "'" ? lastPos : findNextQuotationMark(html, i + 1);
      continue;
    }
    if (tmpName !== false) {
      if (
        i === lastMarkPos
      ) {
        j = html.indexOf(c, i + 1);
        if (j === -1) {
          break;
        } else {
          v = _.trim(html.slice(lastMarkPos + 1, j));
          addAttr(tmpName, v);
          tmpName = false;
          i = j;
          lastPos = i + 1;
          continue;
        }
      }
    }
    if (/\s|\n|\t/.test(c)) {
      html = html.replace(/\s|\n|\t/g, " ");
      if (tmpName === false) {
        j = findNextEqual(html, i);
        if (j === -1) {
          v = _.trim(html.slice(lastPos, i));
          addAttr(v);
          tmpName = false;
          lastPos = i + 1;
          continue;
        } else {
          i = j - 1;
          continue;
        }
      } else {
        j = findBeforeEqual(html, i - 1);
        if (j === -1) {
          v = _.trim(html.slice(lastPos, i));
          v = stripQuoteWrap(v);
          addAttr(tmpName, v);
          tmpName = false;
          lastPos = i + 1;
          continue;
        } else {
          continue;
        }
      }
    }
  }

  if (lastPos < html.length) {
    if (tmpName === false) {
      addAttr(html.slice(lastPos));
    } else {
      addAttr(tmpName, stripQuoteWrap(_.trim(html.slice(lastPos))));
    }
  }

  return _.trim(retAttrs.join(" "));
}

function findNextEqual(str, i) {
  for (; i < str.length; i++) {
    var c = str[i];
    if (c === " ") continue;
    if (c === "=") return i;
    return -1;
  }
}

function findNextQuotationMark(str, i) {
  for (; i < str.length; i++) {
    var c = str[i];
    if (c === " ") continue;
    if (c === "'" || c === '"') return i;
    return -1;
  }
}

function findBeforeEqual(str, i) {
  for (; i > 0; i--) {
    var c = str[i];
    if (c === " ") continue;
    if (c === "=") return i;
    return -1;
  }
}

function isQuoteWrapString(text) {
  if (
    (text[0] === '"' && text[text.length - 1] === '"') ||
    (text[0] === "'" && text[text.length - 1] === "'")
  ) {
    return true;
  } else {
    return false;
  }
}

function stripQuoteWrap(text) {
  if (isQuoteWrapString(text)) {
    return text.substr(1, text.length - 2);
  } else {
    return text;
  }
}

exports.parseTag = parseTag;
exports.parseAttr = parseAttr;

1	/**
2	* Simple HTML Parser
3	*
4	* @author Zongmin Lei<leizongmin@gmail.com>
5	*/
6
7	var _ = require("./util");	1✔
8
9	/**
10	* get tag name
11	*
12	* @param {String} html e.g. '<a hef="#">'
13	* @return {String}
14	*/
15	function getTagName(html) {
16	let i = _.spaceIndex(html);	249✔
17	let tagName;
18	if (i === -1) {	249✔
19	tagName = html.slice(1, -1);	138✔
20	} else {
21	tagName = html.slice(1, i + 1);	111✔
22	}
23	tagName = _.trim(tagName).toLowerCase();	249✔
24	if (tagName.slice(0, 1) === "/") tagName = tagName.slice(1);	249✔
25	if (tagName.slice(-1) === "/") tagName = tagName.slice(0, -1);	249✔
26	return tagName;	249✔
27	}
28
29	/**
30	* is close tag?
31	*
32	* @param {String} html 如：'<a hef="#">'
33	* @return {Boolean}
34	*/
35	function isClosing(html) {
36	return html.slice(0, 2) === "</";	249✔
37	}
38
39	/**
40	* parse input html and returns processed html
41	*
42	* @param {String} html
43	* @param {Function} onTag e.g. function (sourcePosition, position, tag, html, isClosing)
44	* @param {Function} escapeHtml
45	* @return {String}
46	*/
47	function parseTag(html, onTag, escapeHtml) {
48	"use strict";
49
50	var rethtml = "";	147✔
51	var lastPos = 0;	147✔
52	var tagStart = false;	147✔
53	var quoteStart = false;	147✔
54	var currentPos = 0;	147✔
55	var len = html.length;	147✔
56	var currentTagName = "";	147✔
57	var currentHtml = "";	147✔
58
59	chariterator: for (currentPos = 0; currentPos < len; currentPos++) {	147✔
60	var c = html.charAt(currentPos);	4,905✔
61	if (tagStart === false) {	4,905✔
62	if (c === "<") {	621✔
63	tagStart = currentPos;	252✔
64	continue;	252✔
65	}
66	} else {
67	if (quoteStart === false) {	4,284✔
68	if (c === "<") {	3,001✔
69	rethtml += escapeHtml(html.slice(lastPos, currentPos));	7✔
70	tagStart = currentPos;	7✔
71	lastPos = currentPos;	7✔
72	continue;	7✔
73	}
74	if (c === ">") {	2,994✔
75	rethtml += escapeHtml(html.slice(lastPos, tagStart));	249✔
76	currentHtml = html.slice(tagStart, currentPos + 1);	249✔
77	currentTagName = getTagName(currentHtml);	249✔
78	rethtml += onTag(	249✔
79	tagStart,
80	rethtml.length,
81	currentTagName,
82	currentHtml,
83	isClosing(currentHtml)
84	);
85	lastPos = currentPos + 1;	249✔
86	tagStart = false;	249✔
87	continue;	249✔
88	}
89	if (c === '"' \|\| c === "'") {	2,745✔
90	var i = 1;	135✔
91	var ic = html.charAt(currentPos - i);	135✔
92
93	while (ic.trim() === "" \|\| ic === "=") {	135✔
94	if (ic === "=") {	126✔
95	quoteStart = c;	111✔
96	continue chariterator;	111✔
97	}
98	ic = html.charAt(currentPos - ++i);	15✔
99	}
100	}
101	} else {
102	if (c === quoteStart) {	1,283✔
103	quoteStart = false;	111✔
104	continue;	111✔
105	}
106	}
107	}
108	}
109	if (lastPos < html.length) {	147✔
110	rethtml += escapeHtml(html.substr(lastPos));	23✔
111	}
112
113	return rethtml;	147✔
114	}
115
116	var REGEXP_ILLEGAL_ATTR_NAME = /[^a-zA-Z0-9\\_:.-]/gim;	1✔
117
118	/**
119	* parse input attributes and returns processed attributes
120	*
121	* @param {String} html e.g. `href="#" target="_blank"`
122	* @param {Function} onAttr e.g. `function (name, value)`
123	* @return {String}
124	*/
125	function parseAttr(html, onAttr) {
126	"use strict";
127
128	var lastPos = 0;	120✔
129	var lastMarkPos = 0;	120✔
130	var retAttrs = [];	120✔
131	var tmpName = false;	120✔
132	var len = html.length;	120✔
133
134	function addAttr(name, value) {
135	name = _.trim(name);	211✔
136	name = name.replace(REGEXP_ILLEGAL_ATTR_NAME, "").toLowerCase();	211✔
137	if (name.length < 1) return;	211✔
138	var ret = onAttr(name, value \|\| "");	155✔
139	if (ret) retAttrs.push(ret);	155✔
140	}
141
142	// 逐个分析字符
143	for (var i = 0; i < len; i++) {	120✔
144	var c = html.charAt(i);	1,787✔
145	var v, j;
146	if (tmpName === false && c === "=") {	1,787✔
147	tmpName = html.slice(lastPos, i);	138✔
148	lastPos = i + 1;	138✔
149	lastMarkPos = html.charAt(lastPos) === '"' \|\| html.charAt(lastPos) === "'" ? lastPos : findNextQuotationMark(html, i + 1);	138✔
150	continue;	138✔
151	}
152	if (tmpName !== false) {	1,649✔
153	if (	862✔
154	i === lastMarkPos
155	) {
156	j = html.indexOf(c, i + 1);	98✔
157	if (j === -1) {	98!
158	break;	×
159	} else {
160	v = _.trim(html.slice(lastMarkPos + 1, j));	98✔
161	addAttr(tmpName, v);	98✔
162	tmpName = false;	98✔
163	i = j;	98✔
164	lastPos = i + 1;	98✔
165	continue;	98✔
166	}
167	}
168	}
169	if (/\s\|\n\|\t/.test(c)) {	1,551✔
170	html = html.replace(/\s\|\n\|\t/g, " ");	137✔
171	if (tmpName === false) {	137✔
172	j = findNextEqual(html, i);	87✔
173	if (j === -1) {	87✔
174	v = _.trim(html.slice(lastPos, i));	64✔
175	addAttr(v);	64✔
176	tmpName = false;	64✔
177	lastPos = i + 1;	64✔
178	continue;	64✔
179	} else {
180	i = j - 1;	23✔
181	continue;	23✔
182	}
183	} else {
184	j = findBeforeEqual(html, i - 1);	50✔
185	if (j === -1) {	50✔
186	v = _.trim(html.slice(lastPos, i));	26✔
187	v = stripQuoteWrap(v);	26✔
188	addAttr(tmpName, v);	26✔
189	tmpName = false;	26✔
190	lastPos = i + 1;	26✔
191	continue;	26✔
192	} else {
193	continue;	24✔
194	}
195	}
196	}
197	}
198
199	if (lastPos < html.length) {	120✔
200	if (tmpName === false) {	23✔
201	addAttr(html.slice(lastPos));	9✔
202	} else {
203	addAttr(tmpName, stripQuoteWrap(_.trim(html.slice(lastPos))));	14✔
204	}
205	}
206
207	return _.trim(retAttrs.join(" "));	120✔
208	}
209
210	function findNextEqual(str, i) {
211	for (; i < str.length; i++) {	87✔
212	var c = str[i];	240✔
213	if (c === " ") continue;	240✔
214	if (c === "=") return i;	87✔
215	return -1;	64✔
216	}
217	}
218
219	function findNextQuotationMark(str, i) {
220	for (; i < str.length; i++) {	50✔
221	var c = str[i];	74✔
222	if (c === " ") continue;	74✔
223	if (c === "'" \|\| c === '"') return i;	50✔
224	return -1;	40✔
225	}
226	}
227
228	function findBeforeEqual(str, i) {
229	for (; i > 0; i--) {	50✔
230	var c = str[i];	52✔
231	if (c === " ") continue;	52✔
232	if (c === "=") return i;	50✔
233	return -1;	26✔
234	}
235	}
236
237	function isQuoteWrapString(text) {
238	if (	40!
239	(text[0] === '"' && text[text.length - 1] === '"') \|\|	80!
240	(text[0] === "'" && text[text.length - 1] === "'")
241	) {
242	return true;	×
243	} else {
244	return false;	40✔
245	}
246	}
247
248	function stripQuoteWrap(text) {
249	if (isQuoteWrapString(text)) {	40!
250	return text.substr(1, text.length - 2);	×
251	} else {
252	return text;	40✔
253	}
254	}
255
256	exports.parseTag = parseTag;	1✔
257	exports.parseAttr = parseAttr;	1✔

leizongmin / js-xss / #63

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous