IT4Change/Ocelot-Social
3
0
Fork 0
mirror of https://github.com/IT4Change/Ocelot-Social.git synced 2025-12-13 07:45:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improved xss cleaning

Browse Source
This commit is contained in:
Grzegorz Leoniec 2019-01-28 10:06:30 +01:00
parent 3ce814a96f
commit 31d44fe395
No known key found for this signature in database
GPG Key ID: 3AA43686D4EB1377
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/middleware/xssMiddleware.js
View File

@ -95,15 +95,22 @@ function clean (dirty) {
.replace(/<[a-z]>[\s]*<\/[a-z]>/igm, '') .replace(/<[a-z]>[\s]*<\/[a-z]>/igm, '')
// remove all iframes // remove all iframes
.replace(/(<iframe(?!.*?src=(['"]).*?\2)[^>]*)(>)[^>]*\/*>/igm, '') .replace(/(<iframe(?!.*?src=(['"]).*?\2)[^>]*)(>)[^>]*\/*>/igm, '')
// replace all p tags with line breaks (and spaces) only by single linebreaks
.replace(/<p>[\s]*(<br ?\/?>)+[\s]*<\/p>/igm, '<br>')
// replace multiple linebreaks with single ones
// limit linebreaks to max 2 (equivalent to html "br" linebreak)
.replace(/(<br ?\/?>){2,}/igm, '<br>')
.replace(/[\n]{3,}/igm, '\n\n') .replace(/[\n]{3,}/igm, '\n\n')
.replace(/(\r\n|\n\r|\r|\n)/g, '<br>$1') .replace(/(\r\n|\n\r|\r|\n)/g, '<br>$1')
// replace all p tags with line breaks (and spaces) only by single linebreaks
// limit linebreaks to max 2 (equivalent to html "br" linebreak)
.replace(/(<br ?\/?>\s*){2,}/gim, '<br/>')
// remove additional linebreaks after p tags
.replace(
/<\/(p|div|th|tr)>\s*(<br ?\/?>\s*)+\s*<(p|div|th|tr)>/gim,
'</p><p>'
)
// remove additional linebreaks inside p tags // remove additional linebreaks inside p tags
.replace(/<p><br><\/p>/g, '') .replace(
/<(p|div|th|tr)>\s*(<br ?\/?>\s*)+\s*<\/(p|div|th|tr)>/gim,
''
)
return dirty return dirty
} }