cssfilter - npm Package Compare versions

Comparing version 0.0.9 to 0.0.10

lib/css.js

@@ -41,4 +41,5 @@ /**
  *   - {Object} whiteList
- *   - {Object} onAttr
- *   - {Object} onIgnoreAttr
+ *   - {Function} onAttr
+ *   - {Function} onIgnoreAttr
+ *   - {Function} safeAttrValue
  */
@@ -50,2 +51,3 @@ function FilterCSS (options) {
   options.onIgnoreAttr = options.onIgnoreAttr || DEFAULT.onIgnoreAttr;
+  options.safeAttrValue = options.safeAttrValue || DEFAULT.safeAttrValue;
   this.options = options;
@@ -65,2 +67,3 @@ }
   var onIgnoreAttr = options.onIgnoreAttr;
+  var safeAttrValue = options.safeAttrValue;
 
@@ -76,2 +79,6 @@ var retCSS = parseStyle(css, function (sourcePosition, position, name, value, source) {
 
+    // 如果过滤后 value 为空则直接忽略
+    value = safeAttrValue(name, value);
+    if (!value) return;
+
     var opts = {
@@ -78,0 +85,0 @@ position: position,

lib/default.js

@@ -379,3 +379,17 @@ /**
 
+var REGEXP_URL_JAVASCRIPT = /javascript\s*\:/img;
 
+/**
+ * 过滤属性值
+ *
+ * @param {String} name
+ * @param {String} value
+ * @return {String}
+ */
+function safeAttrValue(name, value) {
+  if (REGEXP_URL_JAVASCRIPT.test(value)) return '';
+  return value;
+}
+
+
 exports.whiteList = getDefaultWhiteList();
@@ -385,1 +399,2 @@ exports.getDefaultWhiteList = getDefaultWhiteList;
 exports.onIgnoreAttr = onIgnoreAttr;
+exports.safeAttrValue = safeAttrValue;

package.json

 {
   "name": "cssfilter",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "Sanitize untrusted CSS with a configuration specified by a Whitelist. 根据白名单过滤CSS",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

No alert changes

Improved metrics

Total package byte prevSize

32015

increased by1.81%

Lines of code

607

increased by3.23%

No dependency changes