sanitized 1.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +38 -0
- package/index.js +53 -0
- package/package.json +29 -0
package/README.md
ADDED
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# sanitized
|
|
2
|
+
|
|
3
|
+
sanitized() is a recursive function that'll sanitize a string or ALL strings in an object or array. It's great for sanitizing form data before it gets submitted to the back-end (re: protection against XSS attacks).
|
|
4
|
+
|
|
5
|
+
It accepts two params the first being the value to sanitize, and the second being options to pass to [DOMPurify](https://www.npmjs.com/package/dompurify).
|
|
6
|
+
|
|
7
|
+
## Installation
|
|
8
|
+
|
|
9
|
+
```
|
|
10
|
+
$ npm i sanitized
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
## Usage
|
|
14
|
+
|
|
15
|
+
```javascript
|
|
16
|
+
const sanitized = require("sanitized");
|
|
17
|
+
// or,
|
|
18
|
+
// import sanitized from "sanitized"
|
|
19
|
+
|
|
20
|
+
const test = [
|
|
21
|
+
"<svg><g/onload=alert(2)//<p>",
|
|
22
|
+
{
|
|
23
|
+
name1: [
|
|
24
|
+
'<math><mi//xlink:href="data:x,<script>alert(4)</script>">',
|
|
25
|
+
{ name2: "<p>abc<iframe//src=jAva	script:alert(3)>def" },
|
|
26
|
+
],
|
|
27
|
+
},
|
|
28
|
+
];
|
|
29
|
+
|
|
30
|
+
sanitized(test);
|
|
31
|
+
|
|
32
|
+
// Result:
|
|
33
|
+
//
|
|
34
|
+
// [
|
|
35
|
+
// "<svg><g></g></svg>",
|
|
36
|
+
// { name1: ["<math><mi></mi></math>", { name2: "<p>abc</p>" }] }
|
|
37
|
+
// ];
|
|
38
|
+
```
|
package/index.js
ADDED
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
const DOMPurify = require("dompurify");
|
|
2
|
+
const { decode } = require("he");
|
|
3
|
+
|
|
4
|
+
let sanitizer = (dirty) => dirty;
|
|
5
|
+
|
|
6
|
+
if (DOMPurify.sanitize) {
|
|
7
|
+
sanitizer = (dirty, options) => decode(DOMPurify.sanitize(dirty, options));
|
|
8
|
+
} else {
|
|
9
|
+
try {
|
|
10
|
+
const { JSDOM } = require("jsdom");
|
|
11
|
+
const { window } = new JSDOM("<!DOCTYPE html>");
|
|
12
|
+
DOMPurifyWindow = DOMPurify(window);
|
|
13
|
+
sanitizer = (dirty, options) =>
|
|
14
|
+
decode(DOMPurifyWindow.sanitize(dirty, options));
|
|
15
|
+
} catch (error) {
|
|
16
|
+
console.error(error);
|
|
17
|
+
}
|
|
18
|
+
}
|
|
19
|
+
|
|
20
|
+
function sanitize(dirty, DOMPurifyOptions, callback) {
|
|
21
|
+
try {
|
|
22
|
+
if (typeof dirty === "string")
|
|
23
|
+
return sanitizer(dirty, DOMPurifyOptions, callback);
|
|
24
|
+
|
|
25
|
+
if (dirty && dirty.constructor === Array) {
|
|
26
|
+
let clone = [].concat(dirty);
|
|
27
|
+
for (let i = 0; i < clone.length; i++) {
|
|
28
|
+
clone[i] = sanitize(clone[i], DOMPurifyOptions, callback);
|
|
29
|
+
}
|
|
30
|
+
return clone;
|
|
31
|
+
}
|
|
32
|
+
|
|
33
|
+
if (dirty && dirty.constructor === Object) {
|
|
34
|
+
let clone = JSON.parse(JSON.stringify(dirty));
|
|
35
|
+
let cloneKeys = Object.keys(clone);
|
|
36
|
+
for (let i = 0; i < cloneKeys.length; i++) {
|
|
37
|
+
const cloneKey = cloneKeys[i];
|
|
38
|
+
clone[cloneKey] = sanitize(clone[cloneKey], DOMPurifyOptions, callback);
|
|
39
|
+
}
|
|
40
|
+
return clone;
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
if (callback) callback(null, dirty);
|
|
44
|
+
|
|
45
|
+
return dirty;
|
|
46
|
+
} catch (err) {
|
|
47
|
+
if (callback) callback(err);
|
|
48
|
+
|
|
49
|
+
return dirty;
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
module.exports = sanitize;
|
package/package.json
ADDED
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "sanitized",
|
|
3
|
+
"version": "1.1.5",
|
|
4
|
+
"description": "Recursive function that'll sanitize a string or ALL strings in an object or array.",
|
|
5
|
+
"main": "index.js",
|
|
6
|
+
"scripts": {
|
|
7
|
+
"test": "echo \"Error: no test specified\" && exit 1"
|
|
8
|
+
},
|
|
9
|
+
"repository": {
|
|
10
|
+
"type": "git",
|
|
11
|
+
"url": "git+https://github.com/nameer-rizvi/sanitized.git"
|
|
12
|
+
},
|
|
13
|
+
"keywords": [
|
|
14
|
+
"sanitizer",
|
|
15
|
+
"purifier",
|
|
16
|
+
"XSS"
|
|
17
|
+
],
|
|
18
|
+
"author": "Nameer Rizvi (https://github.com/nameer-rizvi)",
|
|
19
|
+
"license": "ISC",
|
|
20
|
+
"bugs": {
|
|
21
|
+
"url": "https://github.com/nameer-rizvi/sanitized/issues"
|
|
22
|
+
},
|
|
23
|
+
"homepage": "https://github.com/nameer-rizvi/sanitized#readme",
|
|
24
|
+
"dependencies": {
|
|
25
|
+
"dompurify": "^2.3.3",
|
|
26
|
+
"he": "^1.2.0",
|
|
27
|
+
"jsdom": "^17.0.0"
|
|
28
|
+
}
|
|
29
|
+
}
|