diff --git a/src/middleware/xssMiddleware.js b/src/middleware/xssMiddleware.js index 31b2110a7..ef842497e 100644 --- a/src/middleware/xssMiddleware.js +++ b/src/middleware/xssMiddleware.js @@ -92,15 +92,18 @@ function clean (dirty) { // remove empty html tags and duplicated linebreaks and returns dirty = dirty // remove all tags with "space only" - .replace(/<[a-z]>[\s]*<\/[a-z]>/igm, '') + .replace(/<[a-z-]+>[\s]+<\/[a-z-]+>/gim, '') // remove all iframes - .replace(/(]*)(>)[^>]*\/*>/igm, '') - .replace(/[\n]{3,}/igm, '\n\n') - .replace(/(\r\n|\n\r|\r|\n)/g, '
$1') + .replace( + /(]*)(>)[^>]*\/*>/gim, + '' + ) + .replace(/[\n]{3,}/gim, '\n\n') + .replace(/(\r\n|\n\r|\r|\n)/g, '
') // replace all p tags with line breaks (and spaces) only by single linebreaks // limit linebreaks to max 2 (equivalent to html "br" linebreak) - .replace(/(
\s*){2,}/gim, '
') + .replace(/(
\s*){2,}/gim, '
') // remove additional linebreaks after p tags .replace( /<\/(p|div|th|tr)>\s*(
\s*)+\s*<(p|div|th|tr)>/gim, @@ -108,9 +111,13 @@ function clean (dirty) { ) // remove additional linebreaks inside p tags .replace( - /<(p|div|th|tr)>\s*(
\s*)+\s*<\/(p|div|th|tr)>/gim, + /<[a-z-]+>(<[a-z-]+>)*\s*(
\s*)+\s*(<\/[a-z-]+>)*<\/[a-z-]+>/gim, '' ) + // remove additional linebreaks when first child inside p tags + .replace(/

(\s*
\s*)+/gim, '

') + // remove additional linebreaks when last child inside p tags + .replace(/(\s*
\s*)+<\/p+>/gim, '

') return dirty }