diff --git a/.babelrc b/.babelrc index 3291901..28b3ec0 100644 --- a/.babelrc +++ b/.babelrc @@ -1,4 +1,4 @@ { - "plugins": [ "transform-es2015-destructuring", "transform-object-rest-spread" ], + "plugins": [ "transform-es2015-destructuring", "transform-object-rest-spread", "transform-es2015-arrow-functions" ], "retainLines": true } diff --git a/README.md b/README.md new file mode 100644 index 0000000..f3fabc8 --- /dev/null +++ b/README.md @@ -0,0 +1,43 @@ +# htmLawed + +This is a JS rewrite of a very good and safe htmLawed HTML sanitizer, http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/ + +It is safe against almost all possible XSS vectors; see test cases in htmLawed_TESTCASE.txt and rsnake_xss.txt. + +## Install + +`npm install htmlawed` + +## Basic usage + +```js +const htmlawed = require('htmlawed'); +var safe = htmlawed.sanitize('', { safe: 1 }); +``` + +## Config options + +The same config as in the original PHP version is supported. See documentation here: + +http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s2.2 + +The most interesting options are: +* `safe`: sanitize against most XSS +* `elements`: space-delimited allowed HTML elements with '+' or '-' in front. + for example, `* +style` means "allow all standard elements and zhopa

Hello   world!

', { safe: 1, elements: '* +style', style_pass: true }); +var src = ' zhopa

Hello   world!

'; +var res = ' imagezhopa

Hello   world!

'; +var ok = htmLawed.sanitize(src, { safe: 1, elements: '* +style', style_pass: true }); +console.log("[STYLE_PASS] "+(ok ? "OK" : "NOT OK"));