wsemi 1.9.12 → 1.9.13

package/docs/urlParse.mjs.html

@@ -111,7 +111,7 @@ export default urlParse
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sun Oct 11 2026 08:43:48 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Oct 12 2026 12:18:17 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/verifyValue.mjs.html

@@ -224,7 +224,7 @@ export default verifyValue
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sun Oct 11 2026 08:43:48 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Oct 12 2026 12:18:17 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/waitFun.mjs.html

@@ -215,7 +215,7 @@ export default waitFun
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sun Oct 11 2026 08:43:48 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Oct 12 2026 12:18:17 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/docs/wsemi.html

@@ -15465,13 +15465,15 @@ await test3()
     <dt class="tag-description">Description:</dt>
     <dd class="tag-description"><ul class="dummy"><li><p>清除xss攻擊語法</p>
 <p>Depend on: <a href="https://jsxss.com/zh/index.html">https://jsxss.com/zh/index.html</a></p>
+<p>白名單外之標籤轉義，白名單內之標籤刪除白名單外之屬性與危險網址(style屬性保留)，標籤外之文字只轉義會開始標籤之&lt;(其後為英文字母、斜線、驚嘆號、問號或位於結尾)，&gt;與其餘之&lt;維持原樣，故'a &lt; b'等數學式不改寫</p>
+<p>輸出僅供以HTML內文呈現(如v-html、innerHTML)，不可放入屬性值或註解內</p>
 <p>Unit Test: <a href="https://github.com/yuda-lyu/wsemi/blob/master/test/clearXSS.test.mjs">Github</a></p></li></ul></dd>
     
 
     
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="clearXSS.mjs.html">clearXSS.mjs</a>, <a href="clearXSS.mjs.html#line27">line 27</a>
+        <a href="clearXSS.mjs.html">clearXSS.mjs</a>, <a href="clearXSS.mjs.html#line34">line 34</a>
     </li></ul></dd>
     
 
@@ -15518,7 +15520,7 @@ await test3()
 
     <h5 class="h5-examples">Example</h5>
     
-    <pre class="prettyprint"><code>console.log(clearXSS(`>&lt;script>alert('XSS')&lt;/script>`))
+    <pre class="prettyprint"><code>console.log(clearXSS(`>&lt;script>alert('XSS')&lt;/script>`))
 
 
 
@@ -15630,7 +15632,7 @@ await test3()
 
     
 
-    <h4 class="name" id=".clearXSSDyn"><span class="type-signature type-signature-async, static">(async, static) </span>clearXSSDyn<span class="signature">(inp)</span><span class="type-signature"> &rarr; {Promise}</span></h4>
+    <h4 class="name" id=".clearXSSDyn"><span class="type-signature type-signature-async, static">(async, static) </span>clearXSSDyn<span class="signature">(inp, opt<span class="signature-attributes">opt</span>, pathItems)</span><span class="type-signature"> &rarr; {Promise}</span></h4>
 
     
 
@@ -15640,7 +15642,7 @@ await test3()
 <dl class="details">
     
     <dt class="tag-description">Description:</dt>
-    <dd class="tag-description"><ul class="dummy"><li><p>清除xss攻擊語法，採用動態加載技術</p>
+    <dd class="tag-description"><ul class="dummy"><li><p>清除xss攻擊語法，採用動態加載技術，處理規則同clearXSS</p>
 <p>Depend on: <a href="https://jsxss.com/zh/index.html">https://jsxss.com/zh/index.html</a></p>
 <p>Unit Test: <a href="https://github.com/yuda-lyu/wsemi/blob/master/test/clearXSSDyn.test.mjs">Github</a></p></li></ul></dd>
     
@@ -15648,7 +15650,7 @@ await test3()
     
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="clearXSSDyn.mjs.html">clearXSSDyn.mjs</a>, <a href="clearXSSDyn.mjs.html#line28">line 28</a>
+        <a href="clearXSSDyn.mjs.html">clearXSSDyn.mjs</a>, <a href="clearXSSDyn.mjs.html#line30">line 30</a>
     </li></ul></dd>
     
 
@@ -15695,7 +15697,7 @@ await test3()
 
     <h5 class="h5-examples">Example</h5>
     
-    <pre class="prettyprint"><code>let r
+    <pre class="prettyprint"><code>let r
 
 
 
@@ -15713,8 +15715,12 @@ await test3()
         <th>Type</th>
 
         
+        <th>Attributes</th>
+        
 
         
+        <th>Default</th>
+        
 
         <th class="last">Description</th>
     </tr>
@@ -15745,13 +15751,107 @@ await test3()
             </td>
 
             
+                <td class="attributes">
+                
 
+                
+
+                
+                </td>
+            
+
+            
+                <td class="default">
+                
+                </td>
             
 
             <td class="description last"><p>輸入資料</p></td>
         </tr>
 
     
+
+        <tr>
+            
+                <td class="name"><code>opt</code></td>
+            
+
+            <td class="type">
+            
+                
+<span class="param-type">Object</span>
+
+
+
+            
+            </td>
+
+            
+                <td class="attributes">
+                
+                    &lt;optional><br>
+                
+
+                
+
+                
+                </td>
+            
+
+            
+                <td class="default">
+                
+                    <code>{}</code>
+                
+                </td>
+            
+
+            <td class="description last"><p>輸入設定物件，保留簽名相容，目前不使用</p></td>
+        </tr>
+
+    
+
+        <tr>
+            
+                <td class="name"><code>pathItems</code></td>
+            
+
+            <td class="type">
+            
+                
+<span class="param-type">String</span>
+|
+
+<span class="param-type">Object</span>
+|
+
+<span class="param-type">Array</span>
+
+
+
+            
+            </td>
+
+            
+                <td class="attributes">
+                
+
+                
+
+                
+                </td>
+            
+
+            
+                <td class="default">
+                
+                </td>
+            
+
+            <td class="description last"><p>輸入資源字串、字串陣列、物件、物件陣列</p></td>
+        </tr>
+
+    
     </tbody>
 </table>
 
@@ -18830,7 +18930,7 @@ console.log(wb)
 <p>與clearXSS共用同一份js-xss設定(白名單、網址判定、白名單外之style屬性保留)，判定規則：</p>
 <ol>
 <li>
-<p>標籤(type為'tag')：白名單外之標籤，名稱由原始標籤片段取得且其後須接空白、斜線、大於或結尾，故含'&lt;svg/onload=...&gt;'，不含'孔深 &lt; 500 m'、'5&lt;6&gt;4'、'&lt;o:p&gt;'</p>
+<p>標籤(type為'tag')：白名單外之標籤，名稱由原始標籤片段取得且其後須接空白、斜線、大於或結尾，故含'&lt;svg/onload=...&gt;'，不含'孔深 &lt; 500 m'、'5&lt;6&gt;4'、'&lt;o:p&gt;'；結尾未閉合且無屬性之白名單標籤(如'若 a&lt;b'之'&lt;b')亦不計</p>
 </li>
 <li>
 <p>屬性(type為'attr')：白名單內標籤被刪除之事件屬性，名稱為on接英文字母且有值，故不含'a<b and once>c'之once</p>
@@ -18852,7 +18952,7 @@ console.log(wb)
     
     <dt class="tag-source">Source:</dt>
     <dd class="tag-source"><ul class="dummy"><li>
-        <a href="detectXSS.mjs.html">detectXSS.mjs</a>, <a href="detectXSS.mjs.html#line92">line 92</a>
+        <a href="detectXSS.mjs.html">detectXSS.mjs</a>, <a href="detectXSS.mjs.html#line95">line 95</a>
     </li></ul></dd>
     
 
@@ -18917,6 +19017,9 @@ console.log(detectXSS('&amp;lt;b&amp;gt; 為粗體標籤'))
 console.log(detectXSS('孔深 &lt; 500 m 且 > 10 m'))
 // => []
 
+console.log(detectXSS('若 a&lt;b'))
+// => []
+
 console.log(detectXSS('a&lt;b and once>c'))
 // => []
 
@@ -110548,7 +110651,7 @@ console.log(u8arr2u16arr('abc', { returnWithStateAndMsg: true }))
 <br class="clear">
 
 <footer>
-    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Sun Oct 11 2026 08:43:48 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
+    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 4.0.5</a> on Mon Oct 12 2026 12:18:18 GMT+0800 (台北標準時間) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
 </footer>
 
 <script>prettyPrint();</script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wsemi",
-  "version": "1.9.12",
+  "version": "1.9.13",
   "main": "dist/wsemi.umd.js",
   "dependencies": {
     "@zumer/snapdom": "^3.3.0",

package/src/_filterXSS.mjs

@@ -30,9 +30,24 @@ function getFilterXSS(mod = xss) {
 }
 
 
-//getOpt, 取得clearXSS與detectXSS共用之js-xss設定(單一出處), 白名單、網址判定與白名單外標籤之處理皆用js-xss預設, 只另保留白名單外之style屬性(值跳脫<>")
+//reTagStart, 會開始標籤之<: 依HTML規格(Tag open state), <後接英文字母、斜線、驚嘆號或問號才進入標籤、結束標籤、註解等狀態, 其餘之<為一般文字
+//結尾之<亦轉義: 其後字元由組裝處決定, 如兩欄相鄰組進畫面時, 前一欄結尾之<會與後一欄開頭之字母拼成標籤
+//js-xss會分段呼叫escapeHtml, 段尾之<亦視為結尾而轉義, 只多轉義不影響安全(如'a << b'為'a &lt;< b')
+let reTagStart = /<(?=[A-Za-z!/?]|$)/g
+
+
+//escapeHtml, 取代js-xss預設之escapeHtml(<與>全部轉義), 只轉義會開始標籤之<, 令數學式、箭頭、markdown引用等之<與>維持原樣
+//js-xss以此處理標籤外之文字與白名單外之標籤; >於標籤外恆為一般文字故不轉義; 白名單內標籤之屬性值由js-xss之escapeAttrValue另行轉義<>"而不經此函數
+//輸出僅供HTML內文使用, 放入屬性值或註解內並不安全(引號、空白與'-->'皆未轉義)
+function escapeHtml(html) {
+    return html.replace(reTagStart, '&lt;')
+}
+
+
+//getOpt, 取得clearXSS與detectXSS共用之js-xss設定(單一出處), 白名單、網址判定與白名單外標籤之處理皆用js-xss預設, 另保留白名單外之style屬性(值跳脫<>"), 文字之轉義改用escapeHtml
 function getOpt(filterXSS) {
     return {
+        escapeHtml,
         onIgnoreTagAttr: function(tag, name, value, isWhiteAttr) {
             if (name === 'style') {
                 return name + '="' + filterXSS.escapeAttrValue(value) + '"'

package/src/clearXSS.mjs

@@ -11,6 +11,10 @@ import fxss from './_filterXSS.mjs'
  *
  * Depend on: {@link https://jsxss.com/zh/index.html https://jsxss.com/zh/index.html}
  *
+ * 白名單外之標籤轉義，白名單內之標籤刪除白名單外之屬性與危險網址(style屬性保留)，標籤外之文字只轉義會開始標籤之<(其後為英文字母、斜線、驚嘆號、問號或位於結尾)，>與其餘之<維持原樣，故'a < b'等數學式不改寫
+ *
+ * 輸出僅供以HTML內文呈現(如v-html、innerHTML)，不可放入屬性值或註解內
+ *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/clearXSS.test.mjs Github}
  * @memberOf wsemi
  * @param {String|Object|Array} inp 輸入資料
@@ -18,11 +22,14 @@ import fxss from './_filterXSS.mjs'
  * @example
  *
  * console.log(clearXSS(`><script>alert('XSS')</script>`))
- * // => `&gt;&lt;script&gt;alert('XSS')&lt;/script&gt;`
+ * // => `>&lt;script>alert('XSS')&lt;/script>`
  *
  * console.log(clearXSS(`<img src="javascript:alert('XSS')">`))
  * // => `<img src>`
  *
+ * console.log(clearXSS(`孔深 < 500 m 且 > 10 m`))
+ * // => `孔深 < 500 m 且 > 10 m`
+ *
  */
 function clearXSS(inp) {
 

package/src/clearXSSDyn.mjs

@@ -4,13 +4,15 @@ import clearXSS from './clearXSS.mjs'
 
 
 /**
- * 清除xss攻擊語法，採用動態加載技術
+ * 清除xss攻擊語法，採用動態加載技術，處理規則同clearXSS
  *
  * Depend on: {@link https://jsxss.com/zh/index.html https://jsxss.com/zh/index.html}
  *
  * Unit Test: {@link https://github.com/yuda-lyu/wsemi/blob/master/test/clearXSSDyn.test.mjs Github}
  * @memberOf wsemi
  * @param {String|Object|Array} inp 輸入資料
+ * @param {Object} [opt={}] 輸入設定物件，保留簽名相容，目前不使用
+ * @param {String|Object|Array} pathItems 輸入資源字串、字串陣列、物件、物件陣列
  * @returns {Promise} 回傳Promise，resolve回傳輸出資料，reject回傳錯誤訊息
  * @example
  *
@@ -18,7 +20,7 @@ import clearXSS from './clearXSS.mjs'
  *
  * r = await clearXSSDyn(`><script>alert('XSS')</script>`)
  * console.log(r)
- * // => `&gt;&lt;script&gt;alert('XSS')&lt;/script&gt;`
+ * // => `>&lt;script>alert('XSS')&lt;/script>`
  *
  * r = await clearXSSDyn(`<img src="javascript:alert('XSS')">`)
  * console.log(r)

package/src/detectXSS.mjs

@@ -43,7 +43,7 @@ function getScheme(value) {
  *
  * 與clearXSS共用同一份js-xss設定(白名單、網址判定、白名單外之style屬性保留)，判定規則：
  *
- * 1. 標籤(type為'tag')：白名單外之標籤，名稱由原始標籤片段取得且其後須接空白、斜線、大於或結尾，故含'<svg/onload=...>'，不含'孔深 < 500 m'、'5<6>4'、'<o:p>'
+ * 1. 標籤(type為'tag')：白名單外之標籤，名稱由原始標籤片段取得且其後須接空白、斜線、大於或結尾，故含'<svg/onload=...>'，不含'孔深 < 500 m'、'5<6>4'、'<o:p>'；結尾未閉合且無屬性之白名單標籤(如'若 a<b'之'<b')亦不計
  *
  * 2. 屬性(type為'attr')：白名單內標籤被刪除之事件屬性，名稱為on接英文字母且有值，故不含'a<b and once>c'之once
  *
@@ -79,6 +79,9 @@ function getScheme(value) {
  * console.log(detectXSS('孔深 < 500 m 且 > 10 m'))
  * // => []
  *
+ * console.log(detectXSS('若 a<b'))
+ * // => []
+ *
  * console.log(detectXSS('a<b and once>c'))
  * // => []
  *
@@ -105,6 +108,12 @@ function detectXSS(str) {
     let baseOnIgnoreTagAttr = opt.onIgnoreTagAttr || filterXSS.onIgnoreTagAttr
     let baseSafeAttrValue = opt.safeAttrValue || filterXSS.safeAttrValue
 
+    //isWhiteTag, 是否為白名單標籤, 同js-xss以自身屬性判定(不含原型鍵)
+    let whiteList = opt.whiteList || filterXSS.whiteList
+    let isWhiteTag = (name) => {
+        return Object.prototype.hasOwnProperty.call(whiteList, name)
+    }
+
     //rs, add, 重複項目合併為1筆
     let rs = []
     let ks = {}
@@ -128,7 +137,12 @@ function detectXSS(str) {
                 if (r === undefined || r === null) {
                     let m = reTagName.exec(html)
                     if (m) {
-                        add({ type: 'tag', tag: m[1].toLowerCase() })
+                        let name = m[1].toLowerCase()
+                        //結尾未閉合且無屬性之標籤(原始片段恰為'<名稱'或'</名稱'), js-xss取名會少一字而歸為白名單外, 名稱實為白名單者不計(如'若 a<b'之'<b')
+                        if (html.length === m[0].length && isWhiteTag(name)) {
+                            return r
+                        }
+                        add({ type: 'tag', tag: name })
                     }
                 }
                 return r

package/test/_filterXSS.test.mjs

@@ -85,6 +85,24 @@ describe(`_filterXSS`, function() {
             assert.strict.deepStrictEqual(r, '<img src="https://a/b.png">')
         })
 
+        it(`should escape in text only the < that starts a tag or ends the string`, function() {
+            //<後接英文字母、斜線、驚嘆號、問號或位於結尾者轉義, >與其餘之<不轉義
+            let opt = fxss.getOpt(xss)
+            assert.strict.deepStrictEqual(xss('a < b > c', opt), 'a < b > c')
+            assert.strict.deepStrictEqual(xss('x<y', opt), 'x&lt;y')
+            assert.strict.deepStrictEqual(xss('x</y', opt), 'x&lt;/y')
+            assert.strict.deepStrictEqual(xss('x<!y', opt), 'x&lt;!y')
+            assert.strict.deepStrictEqual(xss('x<?y', opt), 'x&lt;?y')
+            assert.strict.deepStrictEqual(xss('a <', opt), 'a &lt;')
+            assert.strict.deepStrictEqual(xss('<svg onload=x()>', opt), '&lt;svg onload=x()>')
+        })
+
+        it(`should not change the escaping of attribute values`, function() {
+            //白名單內標籤之屬性值由js-xss之escapeAttrValue轉義<>", 不經文字之轉義
+            let r = xss('<a href="https://a/b" title="a<b>c">x</a>', fxss.getOpt(xss))
+            assert.strict.deepStrictEqual(r, '<a href="https://a/b" title="a&lt;b&gt;c">x</a>')
+        })
+
     })
 
 })

package/test/clearXSS.test.mjs

@@ -1,4 +1,5 @@
 import assert from 'assert'
+import xss from 'xss'
 import clearXSS from '../src/clearXSS.mjs'
 
 
@@ -9,7 +10,7 @@ describe(`clearXSS`, function() {
 
     k = 1
     x[k] = `><script>alert('XSS')</script>`
-    fx[k] = `&gt;&lt;script&gt;alert('XSS')&lt;/script&gt;`
+    fx[k] = `>&lt;script>alert('XSS')&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 1
         let r = clearXSS(x[k])
@@ -18,7 +19,7 @@ describe(`clearXSS`, function() {
 
     k = 2
     x[k] = `='><script>alert('XSS')</script>`
-    fx[k] = `='&gt;&lt;script&gt;alert('XSS')&lt;/script&gt;`
+    fx[k] = `='>&lt;script>alert('XSS')&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 2
         let r = clearXSS(x[k])
@@ -27,7 +28,7 @@ describe(`clearXSS`, function() {
 
     k = 3
     x[k] = `"><script>alert('XSS')</script>`
-    fx[k] = `"&gt;&lt;script&gt;alert('XSS')&lt;/script&gt;`
+    fx[k] = `">&lt;script>alert('XSS')&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 3
         let r = clearXSS(x[k])
@@ -36,7 +37,7 @@ describe(`clearXSS`, function() {
 
     k = 4
     x[k] = `<script>alert('XSS')</script>`
-    fx[k] = `&lt;script&gt;alert('XSS')&lt;/script&gt;`
+    fx[k] = `&lt;script>alert('XSS')&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 4
         let r = clearXSS(x[k])
@@ -45,7 +46,7 @@ describe(`clearXSS`, function() {
 
     k = 5
     x[k] = `<script>alert (vulnerable)</script>`
-    fx[k] = `&lt;script&gt;alert (vulnerable)&lt;/script&gt;`
+    fx[k] = `&lt;script>alert (vulnerable)&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 5
         let r = clearXSS(x[k])
@@ -63,7 +64,7 @@ describe(`clearXSS`, function() {
 
     k = 7
     x[k] = `<script>alert('XSS')</script>`
-    fx[k] = `&lt;script&gt;alert('XSS')&lt;/script&gt;`
+    fx[k] = `&lt;script>alert('XSS')&lt;/script>`
     it(`should return ' + fx[k] + ' when input ' + x[k]`, function() {
         k = 7
         let r = clearXSS(x[k])
@@ -181,4 +182,145 @@ describe(`clearXSS`, function() {
         assert.strict.deepStrictEqual(r, NaN)
     })
 
+    describe(`標籤外之文字只轉義會開始標籤之<`, function() {
+
+        //不會開始標籤之<(後接空白、數字、符號、非英文字母)與標籤外之>維持原樣
+        let keep = [
+            'a < b',
+            '1 > 0',
+            'x <= 5',
+            'x>=3',
+            '溫度 > 30°C',
+            '孔深 < 500 m 且 > 10 m',
+            'if (a < b && c > d)',
+            '<3',
+            '2<3',
+            'x<=y',
+            '3<4>2',
+            '<新增>',
+            '輸入 -> 輸出 <- 回饋',
+            '> 引用一段話\n\n- 若 a < b 則停止\n- `x => y`',
+        ]
+        for (let s of keep) {
+            it(`should keep ${JSON.stringify(s)}`, function() {
+                assert.strict.deepStrictEqual(clearXSS(s), s)
+            })
+        }
+
+        //<後接英文字母、斜線、驚嘆號、問號, 或位於結尾者轉義(結尾之<於兩欄相鄰組進畫面時會與後一欄開頭拼成標籤)
+        let esc = [
+            ['a<b', 'a&lt;b'],
+            ['x<y>z', 'x&lt;y>z'],
+            ['a <', 'a &lt;'],
+            ['x<', 'x&lt;'],
+            ['請見 <https://example.com>', '請見 &lt;https://example.com>'],
+            ['<script>alert(1)</script>', '&lt;script>alert(1)&lt;/script>'],
+            ['<SCRIPT>alert(1)</SCRIPT>', '&lt;SCRIPT>alert(1)&lt;/SCRIPT>'],
+            ['A<B', 'A&lt;B'],
+            ['<img src="x" onerror="alert(1)"', '&lt;img src="x" onerror="alert(1)"'],
+            ['<svg onload=alert(1)//', '&lt;svg onload=alert(1)//'],
+            ['</title><script>alert(1)</script>', '&lt;/title>&lt;script>alert(1)&lt;/script>'],
+            ['<!DOCTYPE html>', '&lt;!DOCTYPE html>'],
+            ['<?xml version="1.0"?><script>alert(1)</script>', '&lt;?xml version="1.0"?>&lt;script>alert(1)&lt;/script>'],
+        ]
+        for (let [s, e] of esc) {
+            it(`should escape ${JSON.stringify(s)}`, function() {
+                assert.strict.deepStrictEqual(clearXSS(s), e)
+            })
+        }
+
+        it(`should escape the former of two adjacent <`, function() {
+            //js-xss於第二個<前切段而分段轉義, 前者位於段尾視為結尾而轉義, 只多轉義不影響安全
+            assert.strict.deepStrictEqual(clearXSS('a << b'), 'a &lt;< b')
+            assert.strict.deepStrictEqual(clearXSS('x <<= 2'), 'x &lt;<= 2')
+        })
+
+        it(`should apply to strings inside objects and arrays`, function() {
+            let r = clearXSS({ a: 'a < b', b: ['<script>', 1] })
+            assert.strict.deepStrictEqual(r, { a: 'a < b', b: ['&lt;script>', 1] })
+        })
+
+    })
+
+    describe(`白名單內標籤、事件屬性、網址、style、屬性值與註解之處理不變`, function() {
+
+        let same = [
+            ['<img src=x onerror=alert(1)>', '<img src>'],
+            ['<b onclick=alert(1)>x</b>', '<b>x</b>'],
+            ['<a href="javascript:alert(1)">x</a>', '<a href>x</a>'],
+            ['a<b and c>d', 'a<b>d'],
+            ['<div style="a:b<c" title="t">x</div>', '<div style="a:b&lt;c">x</div>'],
+            ['<!-- x -->y', 'y'],
+            //白名單內標籤之屬性值仍由js-xss之escapeAttrValue轉義<>", 不經文字之轉義
+            ['<img alt="1 > 0" src="https://a/b.png">', '<img alt="1 &gt; 0" src="https://a/b.png">'],
+            ['<a href="https://a/b" title="a<b>c">x</a>', '<a href="https://a/b" title="a&lt;b&gt;c">x</a>'],
+            [`<a title='x"y'>z</a>`, '<a title="x&quot;y">z</a>'],
+        ]
+        for (let [s, e] of same) {
+            it(`should keep the handling of ${JSON.stringify(s)}`, function() {
+                assert.strict.deepStrictEqual(clearXSS(s), e)
+            })
+        }
+
+    })
+
+    describe(`兩欄各自清除後相連不會拼出標籤`, function() {
+
+        //相連結果中會開始標籤之<只能是js-xss重建之白名單標籤且不帶事件屬性, 結尾亦不得留下<
+        let reStart = /<(?=[A-Za-z!/?]|$)/g
+        let reTag = /^<\/?([A-Za-z][A-Za-z0-9-]*)(\s[^<>]*)?\/?>$/
+        let isWhite = (name) => Object.prototype.hasOwnProperty.call(xss.whiteList, name)
+        let findBad = (r) => {
+            reStart.lastIndex = 0
+            let m
+            while ((m = reStart.exec(r)) !== null) {
+                let j = r.indexOf('>', m.index)
+                if (j < 0) {
+                    return `unclosed: ${r.slice(m.index)}`
+                }
+                let t = r.slice(m.index, j + 1)
+                let mt = reTag.exec(t)
+                if (!mt || !isWhite(mt[1].toLowerCase())) {
+                    return `tag: ${t}`
+                }
+                if (/\son[a-z]+\s*=/i.test(t)) {
+                    return `event: ${t}`
+                }
+                reStart.lastIndex = j + 1
+            }
+            return ''
+        }
+
+        let attacks = [
+            '<script>alert(1)</script>',
+            '<img src=x onerror=alert(1)>',
+            '<svg onload=alert(1)>',
+            '<svg/onload=alert(1)>',
+            '<a href="javascript:alert(1)">x</a>',
+            '<iframe src=javascript:alert(1)>',
+            '<b onclick=alert(1)>x</b>',
+            '<!--><svg onload=alert(1)>-->',
+            '<?xml?><svg onload=alert(1)>',
+            '</title><script>alert(1)</script>',
+            'x<img src=1 onerror=alert(1)>',
+            'a <b>粗體</b> c',
+            '<table><tr><td>t</td></tr></table>',
+        ]
+
+        it(`should not form tags when two cleared fields are joined at any position`, function() {
+            let bad = []
+            for (let s of attacks) {
+                for (let i = 1; i < s.length; i++) {
+                    let r = clearXSS(s.slice(0, i)) + clearXSS(s.slice(i))
+                    let err = findBad(r)
+                    if (err) {
+                        bad.push({ s, i, r, err })
+                    }
+                }
+            }
+            assert.strict.deepStrictEqual(bad, [])
+        })
+
+    })
+
 })

package/test/detectXSS.test.mjs

@@ -53,6 +53,16 @@ describe(`detectXSS`, function() {
 
         it(`should report the full name of an unclosed tag at the end`, function() {
             check('<script', [tag('script')])
+            check('x<y', [tag('y')])
+            check('<img/src="x"/onerror=alert(1)', [tag('img')])
+        })
+
+        it(`should not report a whitelisted tag left unclosed without attributes at the end`, function() {
+            //js-xss對結尾未閉合且無屬性之標籤取名少一字而歸為白名單外, 名稱實為白名單者不計
+            check('a<b', [])
+            check('若 a<b', [])
+            check('a</b', [])
+            check('<img', [])
         })
 
         it(`should report form controls and custom elements`, function() {

package/toolfp/dist/wsemip.umd.js

@@ -1,5 +1,5 @@
 /*!
- * wsemip v1.9.12
+ * wsemip v1.9.13
  * (c) 2018-2021 yuda-lyu(semisphere)
  * Released under the MIT License.
  */

package/toolparfor/dist/wpf.umd.js

@@ -1,5 +1,5 @@
 /*!
- * wpf v1.9.12
+ * wpf v1.9.13
  * (c) 2018-2021 yuda-lyu(semisphere)
  * Released under the MIT License.
  */

package/toolparfor/dist/wpf_pmSeries.umd.js

@@ -1,5 +1,5 @@
 /*!
- * wpf_pmSeries v1.9.12
+ * wpf_pmSeries v1.9.13
  * (c) 2018-2021 yuda-lyu(semisphere)
  * Released under the MIT License.
  */