diff options
Diffstat (limited to 'public')
| -rw-r--r-- | public/js/render.js | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/public/js/render.js b/public/js/render.js index 1abb68c5..fada5899 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -1,13 +1,23 @@ -function preventXSS(html) { - var options = { - allowCommentTag: true, - onIgnoreTagAttr: function (tag, name, value, isWhiteAttr) { - // allow attr start with 'data-' or equal 'id' and 'class' - if (name.substr(0, 5) === 'data-' || name === 'id' || name === 'class') { - // escape its value using built-in escapeAttrValue function - return name + '="' + filterXSS.escapeAttrValue(value) + '"'; - } +var whiteListAttr = ['id', 'class', 'style']; + +var filterXSSOptions = { + allowCommentTag: true, + onIgnoreTag: function (tag, html, options) { + // allow style in html + if (tag === 'style') { + // do not filter its attributes + return html; + } + }, + onIgnoreTagAttr: function (tag, name, value, isWhiteAttr) { + // allow attr start with 'data-' or in the whiteListAttr + if (name.substr(0, 5) === 'data-' || whiteListAttr.indexOf(name) !== -1) { + // escape its value using built-in escapeAttrValue function + return name + '="' + filterXSS.escapeAttrValue(value) + '"'; } - }; - return filterXSS(html, options); + } +}; + +function preventXSS(html) { + return filterXSS(html, filterXSSOptions); }
\ No newline at end of file |