specter/CyTube
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:calzoneman/sync

Browse source
This commit is contained in:
calzoneman 2013-11-05 22:40:09 -06:00
parent 22ba96b9fd 7318200878
commit 0db5f64b15
2 changed files with 58 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
lib/xss.js
View file

@ -262,4 +262,20 @@ function sanitizeText(str) {
return str; return str;
} }
function decodeText(str) {
str = str.replace(/&#([0-9]{2,4});?/g, function (m, p1) {
return String.fromCharCode(parseInt(p1));
});
str = str.replace(/&#x([0-9a-f]{2,4});?/ig, function (m, p1) {
return String.fromCharCode(parseInt(p1, 16));
});
str = str.replace(/&lt;/g, "<")
.replace(/&gt;/g, ">")
.replace(/&quot;/g, "\"")
.replace(/&amp;/g, "&");
return str;
}
module.exports.sanitizeHTML = sanitizeHTML; module.exports.sanitizeHTML = sanitizeHTML;
module.exports.sanitizeText = sanitizeText;
module.exports.decodeText = decodeText;

59
tests/xss.js
View file

@ -1,21 +1,46 @@
var sanitize = require('../lib/xss').sanitizeHTML; var sanitize = require('../lib/xss');
var sanitizeHTML = sanitize.sanitizeHTML;
var sanitizeText = sanitize.sanitizeText;
var decodeText = sanitize.decodeText;
var assert = require('assert'); var assert = require('assert');
var failed = 0;
function basicTest() { function doTest(s, src, expected) {
assert(sanitize("< script src = bad.js>blah</script>") === try {
"[tag removed]blah[tag removed]"); assert(s(src) === expected);
} catch (e) {
assert(sanitize("< img src=asdf onerror='alert(\"xss\")'>") === failed++;
"<img src=\"asdf\">"); console.log("Expected '" + expected + "'");
console.log("Got '" + s(src) + "'");
assert(sanitize("<a href='javascript:alert(document.cookie)'>") === }
"<a href=\"[removed]:[removed]([removed])\">");
assert(sanitize("<a ") === "<a>");
assert(sanitize("<img src=\"<a href=\"javascript:void(0)\">>") ===
"<img src=\"<a href=\" javascriptvoid0=\"\">>");
} }
basicTest(); function testSanitizeHTML() {
console.log("Tests passed."); doTest(sanitizeHTML, "< script src = bad.js>blah</script>", "[tag removed]blah[tag removed]");
doTest(sanitizeHTML, "< img src=asdf onerror='alert(\"xss\")'>", "<img src=\"asdf\">");
doTest(sanitizeHTML, "<a href='javascript:alert(document.cookie)'>", "<a href=\"[removed]:[removed]([removed])\">");
doTest(sanitizeHTML, "<a ", "<a>");
doTest(sanitizeHTML, "<img src=\"<a href=\"javascript:void(0)\">>", "<img src=\"<a href=\" javascriptvoid0>>");
}
function testSanitizeText() {
doTest(sanitizeText, "<a href=\"#\" onerror=\"javascript:alert('xss')\">", "&lt;a href=&quot;#&quot; onerror=&quot;javascript:alert&#40;&#39;xss&#39;&#41;&quot;&gt;");
doTest(sanitizeText, "&lt;&gt;&amp;&quot;&ccedil;&#x09", "&amp;lt;&amp;gt;&amp;amp;&amp;quot;&amp;ccedil;&amp;#x09");
}
function testDecode() {
doTest(decodeText, "&lt;a href=&quot;#&quot; onerror=&quot;javascript:alert&#40;&#39;xss&#39;&#41;&quot;&gt;", "<a href=\"#\" onerror=\"javascript:alert('xss')\">");
doTest(decodeText, "&amp;lt;&amp;gt;&amp;amp;&amp;quot;&amp;ccedil;&amp;#x09", "&lt;&gt;&amp;&quot;&ccedil;&#x09");
}
testSanitizeHTML();
testSanitizeText();
testDecode();
if (!failed)
console.log("Tests passed.");
else
console.log(""+failed, "tests failed");