├── .coveralls.yml ├── .eslintrc.js ├── .github ├── FUNDING.yml └── workflows │ ├── codeql-analysis.yml │ └── nodejs.yml ├── .gitignore ├── AUTHORS ├── CHANGELOG.md ├── LICENSE ├── README.md ├── README.zh.md ├── SECURITY.md ├── benchmark ├── file.html ├── index.js └── vs_validator.js ├── bin ├── bower_register.cmd ├── build └── xss ├── bower.json ├── dist ├── test.html ├── xss.js └── xss.min.js ├── example ├── allows_attr_prefix.js ├── allows_tag_prefix.js ├── analyse_img_list.js ├── strip_tag.js ├── web.html ├── webworker.html └── worker.js ├── lib ├── cli.js ├── default.js ├── index.js ├── parser.js ├── util.js └── xss.js ├── package.json ├── test ├── test_custom_method.js ├── test_default.js ├── test_html_parser.js └── test_xss.js └── typings ├── tsconfig.json ├── xss-default-import.ts ├── xss-other-tests.ts ├── xss-tests.ts └── xss.d.ts /.coveralls.yml: -------------------------------------------------------------------------------- 1 | service_name: travis-pro 2 | repo_token: 9WQeMOiEjFQQAG2FdKJYZdKuYKLszsjEA 3 | -------------------------------------------------------------------------------- /.eslintrc.js: -------------------------------------------------------------------------------- 1 | module.exports = { 2 | "env": { 3 | "browser": true, 4 | "commonjs": true, 5 | "es2021": true, 6 | "node": true 7 | }, 8 | "extends": "eslint:recommended", 9 | "parserOptions": { 10 | "ecmaVersion": "latest" 11 | }, 12 | "globals": { 13 | "DedicatedWorkerGlobalScope": "readonly", 14 | }, 15 | "rules": { 16 | "no-unused-vars": ["error", { "vars": "all", "args": "none" }], 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # These are supported funding model platforms 2 | 3 | github: leizongmin # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] 4 | patreon: # Replace with a single Patreon username 5 | open_collective: leizongmin # Replace with a single Open Collective username 6 | ko_fi: # Replace with a single Ko-fi username 7 | tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel 8 | custom: # Replace with a single custom sponsorship URL 9 | -------------------------------------------------------------------------------- /.github/workflows/codeql-analysis.yml: -------------------------------------------------------------------------------- 1 | name: "CodeQL" 2 | 3 | on: 4 | push: 5 | branches: [master, ] 6 | pull_request: 7 | # The branches below must be a subset of the branches above 8 | branches: [master] 9 | schedule: 10 | - cron: '0 2 * * 2' 11 | 12 | jobs: 13 | analyse: 14 | name: Analyse 15 | runs-on: ubuntu-latest 16 | 17 | steps: 18 | - name: Checkout repository 19 | uses: actions/checkout@v2 20 | with: 21 | # We must fetch at least the immediate parents so that if this is 22 | # a pull request then we can checkout the head. 23 | fetch-depth: 2 24 | 25 | # If this run was triggered by a pull request event, then checkout 26 | # the head of the pull request instead of the merge commit. 27 | - run: git checkout HEAD^2 28 | if: ${{ github.event_name == 'pull_request' }} 29 | 30 | # Initializes the CodeQL tools for scanning. 31 | - name: Initialize CodeQL 32 | uses: github/codeql-action/init@v1 33 | # Override language selection by uncommenting this and choosing your languages 34 | # with: 35 | # languages: go, javascript, csharp, python, cpp, java 36 | 37 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). 38 | # If this step fails, then you should remove it and run the build manually (see below) 39 | - name: Autobuild 40 | uses: github/codeql-action/autobuild@v1 41 | 42 | # ℹ️ Command-line programs to run using the OS shell. 43 | # 📚 https://git.io/JvXDl 44 | 45 | # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines 46 | # and modify them (or add more) to build your code if your project 47 | # uses a compiled language 48 | 49 | #- run: | 50 | # make bootstrap 51 | # make release 52 | 53 | - name: Perform CodeQL Analysis 54 | uses: github/codeql-action/analyze@v1 55 | -------------------------------------------------------------------------------- /.github/workflows/nodejs.yml: -------------------------------------------------------------------------------- 1 | name: Node.js CI 2 | 3 | on: 4 | push: 5 | branches: [master] 6 | pull_request: 7 | branches: [master] 8 | 9 | jobs: 10 | build: 11 | runs-on: ubuntu-latest 12 | 13 | strategy: 14 | matrix: 15 | node-version: [10.x, 12.x, 14.x, 16.x] 16 | 17 | steps: 18 | - uses: actions/checkout@v2 19 | - name: Use Node.js ${{ matrix.node-version }} 20 | uses: actions/setup-node@v1 21 | with: 22 | node-version: ${{ matrix.node-version }} 23 | - run: npm install 24 | - run: npm run test-cov && npm run coveralls 25 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | lib-cov 2 | *.seed 3 | *.log 4 | *.csv 5 | *.dat 6 | *.out 7 | *.pid 8 | *.gz 9 | .idea 10 | 11 | pids 12 | logs 13 | results 14 | 15 | node_modules 16 | npm-debug.log 17 | 18 | benchmark/result*.html 19 | 20 | coverage.html 21 | .nyc_output 22 | coverage 23 | 24 | package-lock.json 25 | -------------------------------------------------------------------------------- /AUTHORS: -------------------------------------------------------------------------------- 1 | Zongmin Lei (http://ucdok.com) 2 | -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # CHANGELOG 2 | 3 | ## v1.0.15 (2024-03-03) 4 | 5 | - [feat: add `` to default whitelist](https://github.com/leizongmin/js-xss/pull/279) by @rayrny 6 | - [feat: single-quoted attribute value syntax support](https://github.com/leizongmin/js-xss/pull/287) by @mdk000 7 | 8 | ## v1.0.14 (2022-08-16) 9 | 10 | - [fix: problem with not closed tag](https://github.com/leizongmin/js-xss/pull/262) by @slawiko 11 | - [fix: add allowList to types](https://github.com/leizongmin/js-xss/pull/261) by @metonym 12 | 13 | ## v1.0.13 (2022-06-07) 14 | 15 | - [revert: fix: comment has encoded](https://github.com/leizongmin/js-xss/pull/257) 16 | 17 | ## v1.0.12 (2022-06-04) 18 | 19 | - [feat: add eslint:recommended check](https://github.com/leizongmin/js-xss/pull/252) by @lumburr 20 | - [fix: comment has encoded](https://github.com/leizongmin/js-xss/pull/257) by @lumburr 21 | - [fix: whitelist match failure due to case ignoring](https://github.com/leizongmin/js-xss/pull/256) by @lumburr 22 | - [fix: class is wrong separated by attributes in method onTagAttr](https://github.com/leizongmin/js-xss/pull/253) by @lumburr 23 | 24 | ## v1.0.11 (2022-03-06) 25 | 26 | - [feat: add support for allowList as an alias for whiteList](https://github.com/leizongmin/js-xss/pull/249) by @schu34 27 | 28 | ## v1.0.10 (2021-10-08) 29 | 30 | - [Fix: #239 stripCommentTag DoS attack](https://github.com/leizongmin/js-xss/pull/239) 31 | 32 | ## v1.0.9 (2021-05-06) 33 | 34 | - [Fix whitespace bypass #218](https://github.com/leizongmin/js-xss/pull/218/files) by @TomAnthony 35 | - [Add `` to default whitelist #216](https://github.com/leizongmin/js-xss/pull/216) by @spacegaier 36 | - [Add `
` and `
` to default whitelist](https://github.com/leizongmin/js-xss/pull/220) by @daraz999 37 | - Add `