summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCheng-Han, Wu2016-02-16 09:51:22 -0600
committerCheng-Han, Wu2016-02-16 09:51:22 -0600
commit2501b190ab16ba997557537725df4633b7e96e02 (patch)
treefe0eb5ce889c8815431fca6576c2dcbe779f4cb5
parent26c40dca2d93a75db00232752cb16fc2972ec1d4 (diff)
Updated to support html comment tag in XSS
Diffstat (limited to '')
-rw-r--r--public/js/render.js3
1 files changed, 2 insertions, 1 deletions
diff --git a/public/js/render.js b/public/js/render.js
index fada5899..18da145c 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -1,10 +1,11 @@
+var whiteListTag = ['style', '!--'];
var whiteListAttr = ['id', 'class', 'style'];
var filterXSSOptions = {
allowCommentTag: true,
onIgnoreTag: function (tag, html, options) {
// allow style in html
- if (tag === 'style') {
+ if (whiteListTag.indexOf(tag) !== -1) {
// do not filter its attributes
return html;
}