leizongmin/js-xss
Js Xss
js-xss este un sanitizer HTML XSS și un filtru HTML bazat pe whitelist conceput pentru a elimina codul malițios din HTML-ul neverificat. Servește ca un instrument pentru prevenirea cross-site scripting-ului și gestionarea conținutului generat de utilizatori prin curățarea șirurilor HTML pentru a asigura o randare sigură în browser.
Biblioteca include un validator de stil CSS pentru a curăța stilurile inline în raport cu un whitelist și un purificator de conținut HTML capabil să elimine toate tag-urile pentru a extrage textul brut. Permite filtrarea HTML personalizată prin definirea unor reguli specifice și funcții handler pentru a controla elementele și atributele permise.
Instrumentul acoperă o gamă largă de capabilități de sanitizare, inclusiv filtrarea prefixelor de atribute și tag-uri, eliminarea conținutului nepermis și urmărirea elementelor eliminate. Oferă, de asemenea, mecanisme pentru codificarea escape la nivel de caracter și gestionarea elementelor personalizate prin funcții callback.
Utilitarele CLI sunt disponibile pentru procesarea fișierelor HTML și testarea interactivă a regulilor de filtrare.
Features
- Cross-Site Scripting Prevention - Filters untrusted HTML input to remove malicious scripts and prevent cross-site scripting attacks.
- HTML Content Sanitization - Removes malicious scripts, disallowed tags, and HTML comments from untrusted content to prevent XSS attacks.
- HTML Element Filters - Provides mechanisms to define permitted HTML tags and strip unsafe elements based on a whitelist.
- HTML Content Filters - Provides precise control over permitted HTML elements and attributes using custom rules and handlers.
- Character Escaping - Implements mechanisms to replace sensitive characters with HTML entities to prevent browser-based injection attacks.
- CSS Sanitizers - Validates and scrubs inline CSS style attributes against a whitelist to prevent malicious styling injection.
- Customizable Sanitization Rules - Enables the definition of whitelists and replacement functions to precisely control how tags and attributes are processed.
- Whitelist-Based Style Scrubbing - Scrubs inline style attribute values by matching individual CSS properties against a whitelist of safe styles.
- Inline Style Scrubbers - Scrubs inline CSS styles against a whitelist to prevent malicious styling in HTML content.
- User-Generated HTML Validation - Processes and validates HTML submitted by users to maintain a secure environment while allowing limited formatting.
- Custom Sanitization Handlers - Provides callback functions to determine how specific HTML tags and attributes are processed, replaced, or modified.
- Custom Validation Logic - Implements custom functions to handle specific tags or attributes during the filtering process for flexible validation.
- Full Tag Stripping - Provides a mode to strip every HTML element from a string to return only raw text.
- Web Application Security - Implements security layers that scrub dangerous elements and inline styles from dynamic content.
- Element Interception Callbacks - Provides custom handler functions that execute when specific tags or attributes are encountered during the sanitization process.
- Regular Expression-Based Parsing - Uses regular expression patterns to identify and isolate HTML tags and attributes for evaluation and removal.
- Attribute Prefix Filtering - Allows HTML attributes to persist if they start with a specified string, enabling custom data attributes while blocking dangerous ones.
- Raw Text Extractors - Strips all HTML tags from a string to extract only raw text content.
- Sanitization Lifecycle Hooks - Executes custom handler functions when specific tags, attributes, or ignored elements are encountered.
- Node.js Frameworks and Tools - XSS filter based on a whitelist.
- Security and Sanitization - Whitelist-based HTML sanitization.
- Security Middleware - Sanitizes untrusted HTML input using configurable whitelists to prevent XSS.
- Security & Privacy - Filters untrusted HTML to prevent XSS.
