leizongmin / js-xss / #67

pending completion

Build # #67

Build Type

push

travis-pro

Committed by

web-flow

Commit Message

<a href="https://github.com/leizongmin/js-xss/commit/<a class=hub.com/leizongmin/js-xss/commit/f71fcc600acc8f3ae0ce7e7d34f6723a853e3d12">f71fcc600<a href="https://github.com/leizongmin/js-xss/commit/f71fcc600acc8f3ae0ce7e7d34f6723a853e3d12">">Merge </a><a class="double-link" href="https://github.com/leizongmin/js-xss/commit/<a class="double-link" href="https://github.com/leizongmin/js-xss/commit/7ca348bd2f2004e1cfe5e8a0f9dcd6256b81db9b">7ca348bd2</a>">7ca348bd2</a><a href="https://github.com/leizongmin/js-xss/commit/f71fcc600acc8f3ae0ce7e7d34f6723a853e3d12"> into 621b4c220">621b4c220</a>

Run Details

209 of 225 branches covered (92.89%)

10 of 10 new or added lines in 1 file covered. (100.0%)

368 of 381 relevant lines covered (96.59%)

172.46 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.6

/lib/xss.js

/**
 * filter xss
 *
 * @author Zongmin Lei<leizongmin@gmail.com>
 */

var FilterCSS = require("cssfilter").FilterCSS;
var DEFAULT = require("./default");
var parser = require("./parser");
var parseTag = parser.parseTag;
var parseAttr = parser.parseAttr;
var _ = require("./util");

/**
 * returns `true` if the input value is `undefined` or `null`
 *
 * @param {Object} obj
 * @return {Boolean}
 */
function isNull(obj) {
  return obj === undefined || obj === null;
}

/**
 * get attributes for a tag
 *
 * @param {String} html
 * @return {Object}
 *   - {String} html
 *   - {Boolean} closing
 */
function getAttrs(html) {
  var i = _.spaceIndex(html);
  if (i === -1) {
    return {
      html: "",
      closing: html[html.length - 2] === "/",
    };
  }
  html = _.trim(html.slice(i + 1, -1));
  var isClosing = html[html.length - 1] === "/";
  if (isClosing) html = _.trim(html.slice(0, -1));
  return {
    html: html,
    closing: isClosing,
  };
}

/**
 * shallow copy
 *
 * @param {Object} obj
 * @return {Object}
 */
function shallowCopyObject(obj) {
  var ret = {};
  for (var i in obj) {
    ret[i] = obj[i];
  }
  return ret;
}

function keysToLowerCase(obj) {
  var ret = {};
  for (var i in obj) {
    if (Array.isArray(obj[i])) {
      ret[i.toLowerCase()] = obj[i].map(item => {
        return item.toLowerCase();
      });
    } else {
      ret[i.toLowerCase()] = obj[i];
    }
  }
  return ret;
}

/**
 * FilterXSS class
 *
 * @param {Object} options
 *        whiteList (or allowList), onTag, onTagAttr, onIgnoreTag,
 *        onIgnoreTagAttr, safeAttrValue, escapeHtml
 *        stripIgnoreTagBody, allowCommentTag, stripBlankChar
 *        css{whiteList, onAttr, onIgnoreAttr} `css=false` means don't use `cssfilter`
 */
function FilterXSS(options) {
  options = shallowCopyObject(options || {});

  if (options.stripIgnoreTag) {
    if (options.onIgnoreTag) {
      console.error(
        'Notes: cannot use these two options "stripIgnoreTag" and "onIgnoreTag" at the same time'
      );
    }
    options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
  }
  if (options.whiteList || options.allowList) {
    options.whiteList = keysToLowerCase(options.whiteList || options.allowList);
  } else {
    options.whiteList = DEFAULT.whiteList;
  }

  options.onTag = options.onTag || DEFAULT.onTag;
  options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
  options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;
  options.onIgnoreTagAttr = options.onIgnoreTagAttr || DEFAULT.onIgnoreTagAttr;
  options.safeAttrValue = options.safeAttrValue || DEFAULT.safeAttrValue;
  options.escapeHtml = options.escapeHtml || DEFAULT.escapeHtml;
  this.options = options;

  if (options.css === false) {
    this.cssFilter = false;
  } else {
    options.css = options.css || {};
    this.cssFilter = new FilterCSS(options.css);
  }
}

/**
 * start process and returns result
 *
 * @param {String} html
 * @return {String}
 */
FilterXSS.prototype.process = function (html) {
  // compatible with the input
  html = html || "";
  html = html.toString();
  if (!html) return "";

  var me = this;
  var options = me.options;
  var whiteList = options.whiteList;
  var onTag = options.onTag;
  var onIgnoreTag = options.onIgnoreTag;
  var onTagAttr = options.onTagAttr;
  var onIgnoreTagAttr = options.onIgnoreTagAttr;
  var safeAttrValue = options.safeAttrValue;
  var escapeHtml = options.escapeHtml;
  var cssFilter = me.cssFilter;

  // remove invisible characters
  if (options.stripBlankChar) {
    html = DEFAULT.stripBlankChar(html);
  }

  // remove html comments
  if (!options.allowCommentTag) {
    html = DEFAULT.stripCommentTag(html);
  }

  // if enable stripIgnoreTagBody
  var stripIgnoreTagBody = false;
  if (options.stripIgnoreTagBody) {
    stripIgnoreTagBody = DEFAULT.StripTagBody(
      options.stripIgnoreTagBody,
      onIgnoreTag
    );
    onIgnoreTag = stripIgnoreTagBody.onIgnoreTag;
  }

  var retHtml = parseTag(
    html,
    function (sourcePosition, position, tag, html, isClosing) {
      var info = {
        sourcePosition: sourcePosition,
        position: position,
        isClosing: isClosing,
        isWhite: Object.prototype.hasOwnProperty.call(whiteList, tag),
      };

      // call `onTag()`
      var ret = onTag(tag, html, info);
      if (!isNull(ret)) return ret;

      if (info.isWhite) {
        if (info.isClosing) {
          return "</" + tag + ">";
        }

        var attrs = getAttrs(html);
        var whiteAttrList = whiteList[tag];
        var attrsHtml = parseAttr(attrs.html, function (name, value) {
          // call `onTagAttr()`
          var isWhiteAttr = _.indexOf(whiteAttrList, name) !== -1;
          var ret = onTagAttr(tag, name, value, isWhiteAttr);
          if (!isNull(ret)) return ret;

          if (isWhiteAttr) {
            // call `safeAttrValue()`
            value = safeAttrValue(tag, name, value, cssFilter);
            if (value) {
              return name + '="' + value + '"';
            } else {
              return name;
            }
          } else {
            // call `onIgnoreTagAttr()`
            ret = onIgnoreTagAttr(tag, name, value, isWhiteAttr);
            if (!isNull(ret)) return ret;
            return;
          }
        });

        // build new tag html
        html = "<" + tag;
        if (attrsHtml) html += " " + attrsHtml;
        if (attrs.closing) html += " /";
        html += ">";
        return html;
      } else {
        // call `onIgnoreTag()`
        ret = onIgnoreTag(tag, html, info);
        if (!isNull(ret)) return ret;
        return escapeHtml(html);
      }
    },
    escapeHtml
  );

  // if enable stripIgnoreTagBody
  if (stripIgnoreTagBody) {
    retHtml = stripIgnoreTagBody.remove(retHtml);
  }

  return retHtml;
};

module.exports = FilterXSS;

1	/**
2	* filter xss
3	*
4	* @author Zongmin Lei<leizongmin@gmail.com>
5	*/
6
7	var FilterCSS = require("cssfilter").FilterCSS;	1✔
8	var DEFAULT = require("./default");	1✔
9	var parser = require("./parser");	1✔
10	var parseTag = parser.parseTag;	1✔
11	var parseAttr = parser.parseAttr;	1✔
12	var _ = require("./util");	1✔
13
14	/**
15	* returns `true` if the input value is `undefined` or `null`
16	*
17	* @param {Object} obj
18	* @return {Boolean}
19	*/
20	function isNull(obj) {
21	return obj === undefined \|\| obj === null;	496✔
22	}
23
24	/**
25	* get attributes for a tag
26	*
27	* @param {String} html
28	* @return {Object}
29	* - {String} html
30	* - {Boolean} closing
31	*/
32	function getAttrs(html) {
33	var i = _.spaceIndex(html);	119✔
34	if (i === -1) {	119✔
35	return {	25✔
36	html: "",
37	closing: html[html.length - 2] === "/",
38	};
39	}
40	html = _.trim(html.slice(i + 1, -1));	94✔
41	var isClosing = html[html.length - 1] === "/";	94✔
42	if (isClosing) html = _.trim(html.slice(0, -1));	94✔
43	return {	94✔
44	html: html,
45	closing: isClosing,
46	};
47	}
48
49	/**
50	* shallow copy
51	*
52	* @param {Object} obj
53	* @return {Object}
54	*/
55	function shallowCopyObject(obj) {
56	var ret = {};	149✔
57	for (var i in obj) {	149✔
58	ret[i] = obj[i];	46✔
59	}
60	return ret;	149✔
61	}
62
63	function keysToLowerCase(obj) {
64	var ret = {};	16✔
65	for (var i in obj) {	16✔
66	if (Array.isArray(obj[i])) {	210!
67	ret[i.toLowerCase()] = obj[i].map(item => {	210✔
68	return item.toLowerCase();	226✔
69	});
70	} else {
71	ret[i.toLowerCase()] = obj[i];	×
72	}
73	}
74	return ret;	16✔
75	}
76
77	/**
78	* FilterXSS class
79	*
80	* @param {Object} options
81	* whiteList (or allowList), onTag, onTagAttr, onIgnoreTag,
82	* onIgnoreTagAttr, safeAttrValue, escapeHtml
83	* stripIgnoreTagBody, allowCommentTag, stripBlankChar
84	* css{whiteList, onAttr, onIgnoreAttr} `css=false` means don't use `cssfilter`
85	*/
86	function FilterXSS(options) {
87	options = shallowCopyObject(options \|\| {});	149✔
88
89	if (options.stripIgnoreTag) {	149✔
90	if (options.onIgnoreTag) {	3!
91	console.error(	×
92	'Notes: cannot use these two options "stripIgnoreTag" and "onIgnoreTag" at the same time'
93	);
94	}
95	options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;	3✔
96	}
97	if (options.whiteList \|\| options.allowList) {	149✔
98	options.whiteList = keysToLowerCase(options.whiteList \|\| options.allowList);	16✔
99	} else {
100	options.whiteList = DEFAULT.whiteList;	133✔
101	}
102
103	options.onTag = options.onTag \|\| DEFAULT.onTag;	149✔
104	options.onTagAttr = options.onTagAttr \|\| DEFAULT.onTagAttr;	149✔
105	options.onIgnoreTag = options.onIgnoreTag \|\| DEFAULT.onIgnoreTag;	149✔
106	options.onIgnoreTagAttr = options.onIgnoreTagAttr \|\| DEFAULT.onIgnoreTagAttr;	149✔
107	options.safeAttrValue = options.safeAttrValue \|\| DEFAULT.safeAttrValue;	149✔
108	options.escapeHtml = options.escapeHtml \|\| DEFAULT.escapeHtml;	149✔
109	this.options = options;	149✔
110
111	if (options.css === false) {	149✔
112	this.cssFilter = false;	1✔
113	} else {
114	options.css = options.css \|\| {};	148✔
115	this.cssFilter = new FilterCSS(options.css);	148✔
116	}
117	}
118
119	/**
120	* start process and returns result
121	*
122	* @param {String} html
123	* @return {String}
124	*/
125	FilterXSS.prototype.process = function (html) {	1✔
126	// compatible with the input
127	html = html \|\| "";	148✔
128	html = html.toString();	148✔
129	if (!html) return "";	148✔
130
131	var me = this;	146✔
132	var options = me.options;	146✔
133	var whiteList = options.whiteList;	146✔
134	var onTag = options.onTag;	146✔
135	var onIgnoreTag = options.onIgnoreTag;	146✔
136	var onTagAttr = options.onTagAttr;	146✔
137	var onIgnoreTagAttr = options.onIgnoreTagAttr;	146✔
138	var safeAttrValue = options.safeAttrValue;	146✔
139	var escapeHtml = options.escapeHtml;	146✔
140	var cssFilter = me.cssFilter;	146✔
141
142	// remove invisible characters
143	if (options.stripBlankChar) {	146✔
144	html = DEFAULT.stripBlankChar(html);	1✔
145	}
146
147	// remove html comments
148	if (!options.allowCommentTag) {	146✔
149	html = DEFAULT.stripCommentTag(html);	145✔
150	}
151
152	// if enable stripIgnoreTagBody
153	var stripIgnoreTagBody = false;	146✔
154	if (options.stripIgnoreTagBody) {	146✔
155	stripIgnoreTagBody = DEFAULT.StripTagBody(	6✔
156	options.stripIgnoreTagBody,
157	onIgnoreTag
158	);
159	onIgnoreTag = stripIgnoreTagBody.onIgnoreTag;	6✔
160	}
161
162	var retHtml = parseTag(	146✔
163	html,
164	function (sourcePosition, position, tag, html, isClosing) {
165	var info = {	244✔
166	sourcePosition: sourcePosition,
167	position: position,
168	isClosing: isClosing,
169	isWhite: Object.prototype.hasOwnProperty.call(whiteList, tag),
170	};
171
172	// call `onTag()`
173	var ret = onTag(tag, html, info);	244✔
174	if (!isNull(ret)) return ret;	244✔
175
176	if (info.isWhite) {	235✔
177	if (info.isClosing) {	153✔
178	return "</" + tag + ">";	34✔
179	}
180
181	var attrs = getAttrs(html);	119✔
182	var whiteAttrList = whiteList[tag];	119✔
183	var attrsHtml = parseAttr(attrs.html, function (name, value) {	119✔
184	// call `onTagAttr()`
185	var isWhiteAttr = _.indexOf(whiteAttrList, name) !== -1;	146✔
186	var ret = onTagAttr(tag, name, value, isWhiteAttr);	146✔
187	if (!isNull(ret)) return ret;	146✔
188
189	if (isWhiteAttr) {	142✔
190	// call `safeAttrValue()`
191	value = safeAttrValue(tag, name, value, cssFilter);	118✔
192	if (value) {	118✔
193	return name + '="' + value + '"';	75✔
194	} else {
195	return name;	43✔
196	}
197	} else {
198	// call `onIgnoreTagAttr()`
199	ret = onIgnoreTagAttr(tag, name, value, isWhiteAttr);	24✔
200	if (!isNull(ret)) return ret;	24✔
201	return;	22✔
202	}
203	});
204
205	// build new tag html
206	html = "<" + tag;	119✔
207	if (attrsHtml) html += " " + attrsHtml;	119✔
208	if (attrs.closing) html += " /";	119✔
209	html += ">";	119✔
210	return html;	119✔
211	} else {
212	// call `onIgnoreTag()`
213	ret = onIgnoreTag(tag, html, info);	82✔
214	if (!isNull(ret)) return ret;	82✔
215	return escapeHtml(html);	54✔
216	}
217	},
218	escapeHtml
219	);
220
221	// if enable stripIgnoreTagBody
222	if (stripIgnoreTagBody) {	146✔
223	retHtml = stripIgnoreTagBody.remove(retHtml);	6✔
224	}
225
226	return retHtml;	146✔
227	};
228
229	module.exports = FilterXSS;	1✔

leizongmin / js-xss / #67

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous