@blocklet/xss 0.1.1

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright 2018-2020 ArcBlock
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,52 @@
+# @blocklet/xss
+
+**@blocklet/xss** is a package that integrates the **xss** refer to the [official documentation](https://www.npmjs.com/package/xss).
+
+## Development
+
+### Install In Blocklet
+
+```
+# You can use npm / yarn
+pnpm add @blocklet/xss
+```
+
+### Install Dependencies
+
+To install the required dependencies, run the following command:
+
+```
+pnpm i
+```
+
+### Build Packages
+
+To build the packages, execute the following command:
+
+```
+pnpm build
+```
+
+### Build, Watch, and Run Development Server
+
+For building, watching changes, and running the development server, use the following command:
+
+```
+pnpm run dev
+```
+
+## Example
+
+```jsx
+const { xss } = require('@blocklet/xss');
+const express = require('express');
+
+const app = express();
+// ---- body-parser ----
+
+app.use(xss());
+```
+
+## License
+
+This package is licensed under the MIT license.

package/es/index.d.ts

@@ -0,0 +1,8 @@
+import { SanitizeOptions } from './types';
+export * from './utils';
+export declare function xss(options?: SanitizeOptions): (req: any, res: any, next: Function) => void;
+declare const _default: {
+    xss: typeof xss;
+    initSanitize: (_options?: SanitizeOptions) => any;
+};
+export default _default;

package/es/index.js

@@ -0,0 +1,17 @@
+import { initSanitize } from "./utils.js";
+export * from "./utils.js";
+export function xss(options = {}) {
+  const sanitize = initSanitize(options);
+  return (req, res, next) => {
+    ["body", "params", "headers", "query"].forEach((k) => {
+      if (req[k]) {
+        req[k] = sanitize(req[k]);
+      }
+    });
+    next();
+  };
+}
+export default {
+  xss,
+  initSanitize
+};

package/es/types.d.ts

@@ -0,0 +1,4 @@
+import * as xss from 'xss';
+export interface SanitizeOptions extends xss.IFilterXSSOptions {
+    allowedKeys?: string[];
+}

package/es/utils.d.ts

@@ -0,0 +1,2 @@
+import { SanitizeOptions } from './types';
+export declare const initSanitize: (_options?: SanitizeOptions) => any;

package/es/utils.js

@@ -0,0 +1,59 @@
+import * as xss from "xss";
+let defaultOptions = {
+  escapeHtml: (str) => str,
+  stripIgnoreTag: true,
+  stripIgnoreTagBody: ["script"]
+};
+function hasOwn(object, key) {
+  const keys = Reflect.ownKeys(object).filter((item) => typeof item !== "symbol");
+  return keys.includes(key);
+}
+const initializeOptions = (options) => {
+  const sanitizerOptions = {};
+  if (hasOwn(options, "allowedKeys") && Array.isArray(options.allowedKeys) && options.allowedKeys.length > 0) {
+    sanitizerOptions.allowedKeys = options.allowedKeys;
+  }
+  if (hasOwn(options, "whiteList") && typeof options.whiteList === "object") {
+    sanitizerOptions.whiteList = options.whiteList;
+  }
+  return sanitizerOptions;
+};
+export const initSanitize = (_options = {}) => {
+  const options = {
+    ...defaultOptions,
+    ...initializeOptions(_options)
+  };
+  const xssInstance = new xss.FilterXSS(options);
+  const sanitize = (data) => {
+    if (typeof data === "string") {
+      return xssInstance.process(data);
+    }
+    if (Array.isArray(data)) {
+      return data.map((item) => {
+        if (typeof item === "string") {
+          return xssInstance.process(item);
+        }
+        if (Array.isArray(item) || typeof item === "object") {
+          return sanitize(item);
+        }
+        return item;
+      });
+    }
+    if (typeof data === "object" && data !== null) {
+      Object.keys(data).forEach((key) => {
+        if (options?.allowedKeys?.includes(key)) {
+          return;
+        }
+        const item = data[key];
+        if (typeof item === "string") {
+          data[key] = xssInstance.process(item);
+        } else if (Array.isArray(item) || typeof item === "object") {
+          data[key] = sanitize(item);
+        }
+      });
+    }
+    return data;
+  };
+  console.info("sanitize ready:", options);
+  return sanitize;
+};

package/lib/index.d.ts

@@ -0,0 +1,8 @@
+import { SanitizeOptions } from './types';
+export * from './utils';
+export declare function xss(options?: SanitizeOptions): (req: any, res: any, next: Function) => void;
+declare const _default: {
+    xss: typeof xss;
+    initSanitize: (_options?: SanitizeOptions) => any;
+};
+export default _default;

package/lib/index.js

@@ -0,0 +1,37 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+var _exportNames = {
+  xss: true
+};
+
+exports.xss = xss;
+var _utils = require("./utils");
+Object.keys(_utils).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _utils[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _utils[key];
+    }
+  });
+});
+function xss(options = {}) {
+  const sanitize = (0, _utils.initSanitize)(options);
+  return (req, res, next) => {
+    ["body", "params", "headers", "query"].forEach(k => {
+      if (req[k]) {
+        req[k] = sanitize(req[k]);
+      }
+    });
+    next();
+  };
+}
+module.exports = {
+  xss,
+  initSanitize: _utils.initSanitize
+};

package/lib/types.d.ts

@@ -0,0 +1,4 @@
+import * as xss from 'xss';
+export interface SanitizeOptions extends xss.IFilterXSSOptions {
+    allowedKeys?: string[];
+}

package/lib/types.js

@@ -0,0 +1 @@
+"use strict";

package/lib/utils.d.ts

@@ -0,0 +1,2 @@
+import { SanitizeOptions } from './types';
+export declare const initSanitize: (_options?: SanitizeOptions) => any;

package/lib/utils.js

@@ -0,0 +1,68 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.initSanitize = void 0;
+var xss = _interopRequireWildcard(require("xss"));
+function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
+function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && Object.prototype.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+let defaultOptions = {
+  escapeHtml: str => str,
+  stripIgnoreTag: true,
+  stripIgnoreTagBody: ["script"]
+};
+function hasOwn(object, key) {
+  const keys = Reflect.ownKeys(object).filter(item => typeof item !== "symbol");
+  return keys.includes(key);
+}
+const initializeOptions = options => {
+  const sanitizerOptions = {};
+  if (hasOwn(options, "allowedKeys") && Array.isArray(options.allowedKeys) && options.allowedKeys.length > 0) {
+    sanitizerOptions.allowedKeys = options.allowedKeys;
+  }
+  if (hasOwn(options, "whiteList") && typeof options.whiteList === "object") {
+    sanitizerOptions.whiteList = options.whiteList;
+  }
+  return sanitizerOptions;
+};
+const initSanitize = (_options = {}) => {
+  const options = {
+    ...defaultOptions,
+    ...initializeOptions(_options)
+  };
+  const xssInstance = new xss.FilterXSS(options);
+  const sanitize = data => {
+    if (typeof data === "string") {
+      return xssInstance.process(data);
+    }
+    if (Array.isArray(data)) {
+      return data.map(item => {
+        if (typeof item === "string") {
+          return xssInstance.process(item);
+        }
+        if (Array.isArray(item) || typeof item === "object") {
+          return sanitize(item);
+        }
+        return item;
+      });
+    }
+    if (typeof data === "object" && data !== null) {
+      Object.keys(data).forEach(key => {
+        if (options?.allowedKeys?.includes(key)) {
+          return;
+        }
+        const item = data[key];
+        if (typeof item === "string") {
+          data[key] = xssInstance.process(item);
+        } else if (Array.isArray(item) || typeof item === "object") {
+          data[key] = sanitize(item);
+        }
+      });
+    }
+    return data;
+  };
+  console.info("sanitize ready:", options);
+  return sanitize;
+};
+exports.initSanitize = initSanitize;

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@blocklet/xss",
+  "version": "0.1.1",
+  "description": "blocklet prevent xss attack",
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "require": "./lib/index.js",
+      "import": "./es/index.js",
+      "types": "./lib/index.d.ts"
+    }
+  },
+  "main": "./lib/index.js",
+  "module": "./es/index.js",
+  "types": "./lib/index.d.ts",
+  "files": [
+    "lib",
+    "es",
+    "*.d.ts"
+  ],
+  "keywords": [
+    "blocklet",
+    "xss"
+  ],
+  "author": "arcblock <blocklet@arcblock.io> https://github.com/blocklet",
+  "license": "MIT",
+  "dependencies": {
+    "xss": "^1.0.14"
+  },
+  "devDependencies": {
+    "@arcblock/eslint-config-ts": "^0.2.4",
+    "@types/chai": "^4.3.17",
+    "@types/mocha": "^10.0.7",
+    "@types/supertest": "^6.0.2",
+    "body-parser": "^1.20.2",
+    "chai": "^5.1.1",
+    "eslint": "^8.57.0",
+    "esm": "^3.2.25",
+    "express": "^4.19.2",
+    "mocha": "^10.7.3",
+    "supertest": "^7.0.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.4.5",
+    "unbuild": "^2.0.0"
+  },
+  "scripts": {
+    "coverage": "pnpm test -- --coverage",
+    "build": "unbuild",
+    "build:watch": "npx nodemon --ext 'ts,tsx,json,js,jsx' --exec 'pnpm run build' --ignore 'lib/*' --ignore 'es/*' ",
+    "dev": "pnpm run build:watch",
+    "prepublish": "pnpm run build",
+    "prebuild:dep": "pnpm run build",
+    "preversion": "npm run lint && npm run test",
+    "test": "mocha"
+  }
+}