IT4Change/Ocelot-Social
3
0
Fork 0
mirror of https://github.com/IT4Change/Ocelot-Social.git synced 2025-12-13 07:45:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated XSS

Browse Source
This commit is contained in:
Grzegorz Leoniec 2019-01-28 11:06:54 +01:00
parent 31d44fe395
commit 8c36d9a740
No known key found for this signature in database
GPG Key ID: 3AA43686D4EB1377
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/middleware/xssMiddleware.js
View File

@ -92,15 +92,18 @@ function clean (dirty) {
// remove empty html tags and duplicated linebreaks and returns // remove empty html tags and duplicated linebreaks and returns
dirty = dirty dirty = dirty
// remove all tags with "space only" // remove all tags with "space only"
.replace(/<[a-z]>[\s]*<\/[a-z]>/igm, '') .replace(/<[a-z-]+>[\s]+<\/[a-z-]+>/gim, '')
// remove all iframes // remove all iframes
.replace(/(<iframe(?!.*?src=(['"]).*?\2)[^>]*)(>)[^>]*\/*>/igm, '') .replace(
.replace(/[\n]{3,}/igm, '\n\n') /(<iframe(?!.*?src=(['"]).*?\2)[^>]*)(>)[^>]*\/*>/gim,
.replace(/(\r\n|\n\r|\r|\n)/g, '<br>$1') ''
)
.replace(/[\n]{3,}/gim, '\n\n')
.replace(/(\r\n|\n\r|\r|\n)/g, '<br>')
// replace all p tags with line breaks (and spaces) only by single linebreaks // replace all p tags with line breaks (and spaces) only by single linebreaks
// limit linebreaks to max 2 (equivalent to html "br" linebreak) // limit linebreaks to max 2 (equivalent to html "br" linebreak)
.replace(/(<br ?\/?>\s*){2,}/gim, '<br/>') .replace(/(<br ?\/?>\s*){2,}/gim, '<br>')
// remove additional linebreaks after p tags // remove additional linebreaks after p tags
.replace( .replace(
/<\/(p|div|th|tr)>\s*(<br ?\/?>\s*)+\s*<(p|div|th|tr)>/gim, /<\/(p|div|th|tr)>\s*(<br ?\/?>\s*)+\s*<(p|div|th|tr)>/gim,
@ -108,9 +111,13 @@ function clean (dirty) {
) )
// remove additional linebreaks inside p tags // remove additional linebreaks inside p tags
.replace( .replace(
/<(p|div|th|tr)>\s*(<br ?\/?>\s*)+\s*<\/(p|div|th|tr)>/gim, /<[a-z-]+>(<[a-z-]+>)*\s*(<br ?\/?>\s*)+\s*(<\/[a-z-]+>)*<\/[a-z-]+>/gim,
'' ''
) )
// remove additional linebreaks when first child inside p tags
.replace(/<p>(\s*<br ?\/?>\s*)+/gim, '<p>')
// remove additional linebreaks when last child inside p tags
.replace(/(\s*<br ?\/?>\s*)+<\/p+>/gim, '</p>')
return dirty return dirty
} }