leizongmin/js-xss
Js Xss
js-xss is an HTML XSS sanitizer and whitelist-based HTML filter designed to remove malicious code from untrusted HTML. It serves as a tool for cross-site scripting prevention and user-generated content management by cleaning HTML strings to ensure safe browser rendering.
The library includes a CSS style validator to scrub inline styles against a whitelist and an HTML content purifier capable of stripping all tags to extract raw text. It allows for custom HTML filtering through the definition of specific rules and handler functions to control permitted elements and attributes.
The tool covers a broad range of sanitization capabilities, including attribute and tag prefix filtering, disallowed content removal, and tracking of stripped elements. It also provides mechanisms for character-level escape encoding and custom element handling via callback functions.
Command-line utilities are available for processing HTML files and interactive testing of filtering rules.
Features
- Cross-Site Scripting Prevention - Filters untrusted HTML input to remove malicious scripts and prevent cross-site scripting attacks.
- HTML Content Sanitization - Removes malicious scripts, disallowed tags, and HTML comments from untrusted content to prevent XSS attacks.
- HTML Element Filters - Provides mechanisms to define permitted HTML tags and strip unsafe elements based on a whitelist.
- HTML Content Filters - Provides precise control over permitted HTML elements and attributes using custom rules and handlers.
- Character Escaping - Implements mechanisms to replace sensitive characters with HTML entities to prevent browser-based injection attacks.
- CSS Sanitizers - Validates and scrubs inline CSS style attributes against a whitelist to prevent malicious styling injection.
- Customizable Sanitization Rules - Enables the definition of whitelists and replacement functions to precisely control how tags and attributes are processed.
- Whitelist-Based Style Scrubbing - Scrubs inline style attribute values by matching individual CSS properties against a whitelist of safe styles.
- Inline Style Scrubbers - Scrubs inline CSS styles against a whitelist to prevent malicious styling in HTML content.
- User-Generated HTML Validation - Processes and validates HTML submitted by users to maintain a secure environment while allowing limited formatting.
- Custom Sanitization Handlers - Provides callback functions to determine how specific HTML tags and attributes are processed, replaced, or modified.
- Custom Validation Logic - Implements custom functions to handle specific tags or attributes during the filtering process for flexible validation.
- Full Tag Stripping - Provides a mode to strip every HTML element from a string to return only raw text.
- Web Application Security - Implements security layers that scrub dangerous elements and inline styles from dynamic content.
- Element Interception Callbacks - Provides custom handler functions that execute when specific tags or attributes are encountered during the sanitization process.
- Regular Expression-Based Parsing - Uses regular expression patterns to identify and isolate HTML tags and attributes for evaluation and removal.
- Attribute Prefix Filtering - Allows HTML attributes to persist if they start with a specified string, enabling custom data attributes while blocking dangerous ones.
- Raw Text Extractors - Strips all HTML tags from a string to extract only raw text content.
- Sanitization Lifecycle Hooks - Executes custom handler functions when specific tags, attributes, or ignored elements are encountered.
- Node.js Frameworks and Tools - XSS filter based on a whitelist.
- Security and Sanitization - Whitelist-based HTML sanitization.
- Security Middleware - Sanitizes untrusted HTML input using configurable whitelists to prevent XSS.
- Security & Privacy - Filters untrusted HTML to prevent XSS.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
