apostrophecms/sanitize-htmlArchived
Sanitize Html
هذه مكتبة تعقيم HTML مصممة لإزالة العلامات والسمات الخطرة من HTML المقدم من المستخدم لمنع هجمات البرمجة عبر المواقع (XSS). تعمل كمرشح محتوى يقوم بإدراج عناصر وسمات محددة في القائمة البيضاء مع الهروب من الترميز غير المصرح به أو تجاهله.
يتضمن المشروع محرك تحويل HTML يسمح بتعديل أو استبدال العلامات والسمات باستخدام منطق مخصص. كما يتميز بمدقق نمط CSS لتنظيف الخصائص المضمنة مقابل الأنماط المسموح بها ونظام للتحقق من صحة عنوان URL للمورد لتقييد أسماء المضيفين والمخططات.
توفر المكتبة إمكانيات لتعقيم مدخلات المستخدم، والتحقق من صحة CSS المضمن، وتحويل HTML الديناميكي. يتم تنفيذ هذه الوظائف عبر محلل يدعم تصفية العلامات وتعريف العناصر المسموح بها.
Features
- Cross-Site Scripting Prevention - Prevents cross-site scripting attacks by stripping unauthorized tags and attributes using a whitelist approach.
- HTML Element Filters - Provides a system to define permitted HTML tags and attributes using exact matches, wildcards, or regex.
- URL Scheme Whitelisting - Validates link and resource destinations by restricting permitted URI protocols and hostnames.
- HTML Content Filters - Controls permitted HTML elements and attributes to ensure security and consistent formatting.
- CSS Sanitizers - Cleans and validates inline CSS properties against permitted patterns to prevent injection attacks.
- Element Whitelisting - Retains only specific HTML tags and attributes that match an explicit permitted whitelist.
- HTML Content Sanitization - Removes dangerous tags and attributes from user-submitted HTML to prevent cross-site scripting attacks.
- Input Sanitization Filters - Cleans user-submitted HTML to remove malicious scripts and dangerous elements before rendering.
- Attribute Injection Validators - Uses regular expressions to validate attributes and CSS properties, preventing malicious code injection.
- CSS Security Validators - Cleans inline CSS properties against permitted patterns to ensure safe styling in user content.
- Inline Style Scrubbers - Filters style attributes to ensure only safe CSS properties and values are permitted.
- Custom Handler Transformations - Provides a transformation engine to modify or replace HTML tags and attributes via custom callback logic.
- HTML Document Transformation - Modifies HTML content using custom logic to meet application-specific requirements during cleaning.
- Parser Event Interception - Allows custom logic to be executed during the opening and closing of tags for advanced filtering.
- Tag Discard Policies - Configures whether forbidden tags are discarded, escaped, or converted to plain text.
- Tag Transformations - Modifies or replaces specific tags and attributes using custom logic during the cleaning process.
- Resource URL Validations - Restricts permitted hostnames and schemes in links and frames to ensure content loads from trusted sources.
- Parser Event-Based Filtering - Implements HTML processing by reacting to streaming parser events for open and close tags.
- Streaming DOM Reconstruction - Builds clean output strings by selectively appending parsed tokens that pass security filters.
- Parsing Tools - HTML sanitization tool.
- Security and Sanitization - Simple API for HTML sanitization.
