Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Strip malformed nested tags #11

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
+71 −12
Open

Strip malformed nested tags #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
361e714
Add basic tests for sanitize in blacklist mode.
ashokak May 26, 2015
4c4d8e2
Rename variables to prepare for adding another test string.
ashokak May 26, 2015
df7ac95
Add failing test for mis-nested script tags.
ashokak May 26, 2015
68573a8
Run sanitization until we hit a fixed-point.
ashokak May 26, 2015
6a657b3
Add failing test for a closing tag with extra content.
ashokak May 26, 2015
5e25bc0
Strip script and style tags, including their bodies, even when their …
ashokak May 26, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions lib/bleach.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,21 @@ var bleach = {
},

sanitize: function(html, options) {
var previousHtml;
var sanitizedHtml = html;

// Apply sanitization until the length stabilizes.
// This is guaranteed to terminate if sanitizeOnce never makes the
// string longer.
do {
previousHtml = sanitizedHtml;
sanitizedHtml = this.sanitizeOnce(previousHtml, options);
} while (sanitizedHtml.length != previousHtml.length);

return sanitizedHtml;
},

sanitizeOnce: function(html, options) {
html = String(html) || '';
options = options || {};

Expand All @@ -70,13 +85,13 @@ var bleach = {

if ((mode == 'white' && list.indexOf('script') == -1)
|| (mode == 'black' && list.indexOf('script') != -1)) {
html = html.replace(/<script(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/script>/gim, '');
html = html.replace(/<script(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/script.*?>/gim, '');
}


if ((mode == 'white' && list.indexOf('style') == -1)
|| (mode == 'black' && list.indexOf('style') != -1)) {
html = html.replace(/<style(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/style>/gim, '');
html = html.replace(/<style(.*?)>(.*?[\r\n])*?(.*?)(.*?[\r\n])*?<\/style.*?>/gim, '');
}

matches.forEach(function(tag){
Expand Down
64 changes: 54 additions & 10 deletions test/script.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,67 @@ var vows = require('vows'),
assert = require('assert'),
bleach = require('../lib/bleach');

var HTML1 = 'This is <a href="#html">HTML</a> with a <script>\nvar x = 1;</script>SCRIPT',
HTML2 = 'This is <a href="#html">HTML</a> with a SCRIPT',
HTML3 = 'This is HTML with a SCRIPT';
var HTML_LINK_SCRIPT = 'This is <a href="#html">HTML</a> with a <script>\nvar x = 1;</script>SCRIPT',
HTML_LINK_SPACE_CLOSED_SCRIPT = 'This is <a href="#html">HTML</a> with a <script>\nvar x = 1;</script >SCRIPT',
HTML_LINK_MISNESTED_SCRIPT = 'This is <a href="#html">HTML</a> with a <scr<script></script>ipt src="evil.js">SCRIPT',
HTML_LINK = 'This is <a href="#html">HTML</a> with a SCRIPT',
HTML_PLAIN = 'This is HTML with a SCRIPT';

vows.describe('script tests').addBatch({

'whitelist mode': {
topic: function (){ return HTML1; },
topic: function (){ return HTML_LINK_SCRIPT; },

'eliminates script tags but keeps listed tags': function (HTML1){
var HTML = bleach.sanitize(HTML1, {mode: 'white', list:['a']});
assert.equal(HTML, HTML2);
'eliminates script tags but keeps listed tags': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'white', list:['a']});
assert.equal(HTML, HTML_LINK);
},

'eliminates all tags when given an empty list': function (HTML1){
var HTML = bleach.sanitize(HTML1, {mode: 'white', list:[]});
assert.equal(HTML, HTML3);
'eliminates all tags when given an empty list': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'white', list:[]});
assert.equal(HTML, HTML_PLAIN);
}
},

'blacklist mode': {
topic: function (){ return HTML_LINK_SCRIPT; },

'eliminates script tags but keeps unlisted tags': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'black', list:['script']});
assert.equal(HTML, HTML_LINK);
},

'eliminates all tags when all are blacklisted': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'black', list:['a', 'script']});
assert.equal(HTML, HTML_PLAIN);
}
},

'nested malformed tags': {
topic: function (){ return HTML_LINK_MISNESTED_SCRIPT; },

'are eliminated but whitelisted tags are kept': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'white', list:['a']});
assert.equal(HTML, HTML_LINK);
},

'are eliminated when blacklisted': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'black', list:['script']});
assert.equal(HTML, HTML_LINK);
},
},

'oddly closed script tags': {
topic: function (){ return HTML_LINK_SPACE_CLOSED_SCRIPT; },

'are eliminated but whitelisted tags are kept': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'white', list:['a']});
assert.equal(HTML, HTML_LINK);
},

'are eliminated when blacklisted': function (topic){
var HTML = bleach.sanitize(topic, {mode: 'black', list:['script']});
assert.equal(HTML, HTML_LINK);
}
}

Expand Down