JavaScript port of htmLawed HTML filter library

Go to file

Vitaliy Filippov 05177d2f3f Fix keep_bad=0 mode		2016-10-03 14:06:28 +03:00
.babelrc	Fix keep_bad=0 mode	2016-10-03 14:06:28 +03:00
.eslintrc.js	Move eslint rule to separate repo	2016-07-05 18:47:27 +03:00
README.md	fix readme	2016-08-27 14:59:35 +03:00
htmLawed.js	Fix keep_bad=0 mode	2016-10-03 14:06:28 +03:00
htmLawed.src.js	Fix keep_bad=0 mode	2016-10-03 14:06:28 +03:00
htmLawed_TESTCASE.txt	add custom eslint no-regex-dot plugin, fix htmLawed bugs (now passes XSS test)	2016-07-05 12:47:44 +03:00
htmLawed_TESTCASE_out.htm	add some tests, rename hl_bal function arg	2016-07-05 16:15:57 +03:00
package.json	Fix keep_bad=0 mode	2016-10-03 14:06:28 +03:00
rsnake_xss.txt	add some tests, rename hl_bal function arg	2016-07-05 16:15:57 +03:00
test.js	Fix keep_bad=0 mode	2016-10-03 14:06:28 +03:00

htmLawed

This is a JS rewrite of a very good and safe htmLawed HTML sanitizer, http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/

It is safe against almost all possible XSS vectors; see test cases in htmLawed_TESTCASE.txt and rsnake_xss.txt.

Install

npm install htmlawed

const htmlawed = require('htmlawed');
var safe = htmlawed.sanitize('<html code>', { safe: 1 });

The same config as in the original PHP version is supported. See documentation here:

The most interesting options are:

safe: sanitize against most XSS
elements: space-delimited allowed HTML elements with '+' or '-' in front. for example, * +style means "allow all standard elements and <style> element".
keep_bad: what to do with bad tags (6 is the default)
0 = remove them
1 = escape tags and element content (replace < > to < >)
2 = remove tags, escape element content
3, 4 = like 1, 2 but remove if text (#PCDATA) is invalid in parent element
5, 6 = like 3, 4 but leave space characters in place
parent: supposed parent element that will be wrapped around content
`tidy: -1 = compact/uglify HTML, 0 = no change (default), 1 = tify/beautify HTML
abs_url: -1 = make relative, 0 = no change (default), 1 = make absolute
base_url: base URL for abs_url to work if not 0

LGPL, because it's a rewrite of the original LGPL-licensed library.