From 9b0eface1e35a9fcf89e050fb0516ed9f4fd9884 Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Sat, 27 Aug 2016 14:54:38 +0300 Subject: [PATCH] add readme --- .babelrc | 2 +- README.md | 43 ++ htmLawed.js | 1338 +++++++++++++++++------------------ htmLawed.src.js | 1288 +++++++++++++++++++++++++++++++++ package.json | 30 +- test-htmLawed.sh | 5 - htmLawed-test.js => test.js | 7 +- 7 files changed, 2034 insertions(+), 679 deletions(-) create mode 100644 README.md create mode 100644 htmLawed.src.js delete mode 100644 test-htmLawed.sh rename htmLawed-test.js => test.js (69%) diff --git a/.babelrc b/.babelrc index 3291901..28b3ec0 100644 --- a/.babelrc +++ b/.babelrc @@ -1,4 +1,4 @@ { - "plugins": [ "transform-es2015-destructuring", "transform-object-rest-spread" ], + "plugins": [ "transform-es2015-destructuring", "transform-object-rest-spread", "transform-es2015-arrow-functions" ], "retainLines": true } diff --git a/README.md b/README.md new file mode 100644 index 0000000..f3fabc8 --- /dev/null +++ b/README.md @@ -0,0 +1,43 @@ +# htmLawed + +This is a JS rewrite of a very good and safe htmLawed HTML sanitizer, http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/ + +It is safe against almost all possible XSS vectors; see test cases in htmLawed_TESTCASE.txt and rsnake_xss.txt. + +## Install + +`npm install htmlawed` + +## Basic usage + +```js +const htmlawed = require('htmlawed'); +var safe = htmlawed.sanitize('', { safe: 1 }); +``` + +## Config options + +The same config as in the original PHP version is supported. See documentation here: + +http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s2.2 + +The most interesting options are: +* `safe`: sanitize against most XSS +* `elements`: space-delimited allowed HTML elements with '+' or '-' in front. + for example, `* +style` means "allow all standard elements and zhopa

Hello   world!

', { safe: 1, elements: '* +style', style_pass: true }); +var src = ' zhopa

Hello   world!

'; +var res = ' imagezhopa

Hello   world!

'; +var ok = htmLawed.sanitize(src, { safe: 1, elements: '* +style', style_pass: true }); +console.log("[STYLE_PASS] "+(ok ? "OK" : "NOT OK"));