@blocklet/xss 0.1.1 → 0.1.3

package/{lib → cjs}/utils.js

@@ -5,31 +5,31 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.initSanitize = void 0;
 var xss = _interopRequireWildcard(require("xss"));
+var _omit = _interopRequireDefault(require("lodash/omit"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
 function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && Object.prototype.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+const ignoreTagList = [
+// here is a blacklist
+"script", "img", "iframe", "body", "form", "style", "link", "meta", "bgsound", "svg", "embed", "object", "video", "audio", "source", "track", "marquee", "blink", "noscript", "param", "textarea", "input", "select", "button"];
+const ignoreTagMap = ignoreTagList.reduce((acc, item) => {
+  acc[item] = true;
+  return acc;
+}, {});
 let defaultOptions = {
   escapeHtml: str => str,
-  stripIgnoreTag: true,
+  whiteList: (0, _omit.default)(xss.getDefaultWhiteList(), ignoreTagList),
+  onIgnoreTag: function (tag, html, options) {
+    if (ignoreTagMap[tag]) {
+      return "";
+    }
+  },
   stripIgnoreTagBody: ["script"]
 };
-function hasOwn(object, key) {
-  const keys = Reflect.ownKeys(object).filter(item => typeof item !== "symbol");
-  return keys.includes(key);
-}
-const initializeOptions = options => {
-  const sanitizerOptions = {};
-  if (hasOwn(options, "allowedKeys") && Array.isArray(options.allowedKeys) && options.allowedKeys.length > 0) {
-    sanitizerOptions.allowedKeys = options.allowedKeys;
-  }
-  if (hasOwn(options, "whiteList") && typeof options.whiteList === "object") {
-    sanitizerOptions.whiteList = options.whiteList;
-  }
-  return sanitizerOptions;
-};
 const initSanitize = (_options = {}) => {
   const options = {
     ...defaultOptions,
-    ...initializeOptions(_options)
+    ..._options
   };
   const xssInstance = new xss.FilterXSS(options);
   const sanitize = data => {

package/es/utils.js

@@ -1,27 +1,50 @@
 import * as xss from "xss";
+import omit from "lodash/omit";
+const ignoreTagList = [
+  // here is a blacklist
+  "script",
+  "img",
+  "iframe",
+  "body",
+  "form",
+  "style",
+  "link",
+  "meta",
+  "bgsound",
+  "svg",
+  "embed",
+  "object",
+  "video",
+  "audio",
+  "source",
+  "track",
+  "marquee",
+  "blink",
+  "noscript",
+  "param",
+  "textarea",
+  "input",
+  "select",
+  "button"
+];
+const ignoreTagMap = ignoreTagList.reduce((acc, item) => {
+  acc[item] = true;
+  return acc;
+}, {});
 let defaultOptions = {
   escapeHtml: (str) => str,
-  stripIgnoreTag: true,
+  whiteList: omit(xss.getDefaultWhiteList(), ignoreTagList),
+  onIgnoreTag: function(tag, html, options) {
+    if (ignoreTagMap[tag]) {
+      return "";
+    }
+  },
   stripIgnoreTagBody: ["script"]
 };
-function hasOwn(object, key) {
-  const keys = Reflect.ownKeys(object).filter((item) => typeof item !== "symbol");
-  return keys.includes(key);
-}
-const initializeOptions = (options) => {
-  const sanitizerOptions = {};
-  if (hasOwn(options, "allowedKeys") && Array.isArray(options.allowedKeys) && options.allowedKeys.length > 0) {
-    sanitizerOptions.allowedKeys = options.allowedKeys;
-  }
-  if (hasOwn(options, "whiteList") && typeof options.whiteList === "object") {
-    sanitizerOptions.whiteList = options.whiteList;
-  }
-  return sanitizerOptions;
-};
 export const initSanitize = (_options = {}) => {
   const options = {
     ...defaultOptions,
-    ...initializeOptions(_options)
+    ..._options
   };
   const xssInstance = new xss.FilterXSS(options);
   const sanitize = (data) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blocklet/xss",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "blocklet prevent xss attack",
   "publishConfig": {
     "access": "public"
@@ -8,16 +8,16 @@
   "sideEffects": false,
   "exports": {
     ".": {
-      "require": "./lib/index.js",
+      "require": "./cjs/index.js",
       "import": "./es/index.js",
-      "types": "./lib/index.d.ts"
+      "types": "./es/index.d.ts"
     }
   },
-  "main": "./lib/index.js",
+  "main": "./cjs/index.js",
   "module": "./es/index.js",
-  "types": "./lib/index.d.ts",
+  "types": "./es/index.d.ts",
   "files": [
-    "lib",
+    "cjs",
     "es",
     "*.d.ts"
   ],
@@ -28,20 +28,22 @@
   "author": "arcblock <blocklet@arcblock.io> https://github.com/blocklet",
   "license": "MIT",
   "dependencies": {
+    "lodash": "^4.17.21",
     "xss": "^1.0.14"
   },
   "devDependencies": {
     "@arcblock/eslint-config-ts": "^0.2.4",
     "@types/chai": "^4.3.17",
-    "@types/mocha": "^10.0.7",
+    "@types/jest": "^29.5.12",
     "@types/supertest": "^6.0.2",
     "body-parser": "^1.20.2",
     "chai": "^5.1.1",
     "eslint": "^8.57.0",
     "esm": "^3.2.25",
     "express": "^4.19.2",
-    "mocha": "^10.7.3",
+    "jest": "^29.7.0",
     "supertest": "^7.0.0",
+    "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
     "unbuild": "^2.0.0"
@@ -54,6 +56,6 @@
     "prepublish": "pnpm run build",
     "prebuild:dep": "pnpm run build",
     "preversion": "npm run lint && npm run test",
-    "test": "mocha"
+    "test": "jest"
   }
 }