Cure53 and GitHub
adecaa0e37
chore: refactoring run pt4, demo touchup, docs, comments, small things ( #1476 )
2026-06-12 12:41:53 +02:00
Mario Heiderich
3e10616ebf
style: reformat codebase with Prettier 3
2026-04-16 11:55:49 +02:00
Dr.-Ing. Mario Heiderich
b316ca4072
See #931
...
fix: fixed the CSS sanitizer demo hook, thanks @koosvanderkolk
2024-04-04 16:09:13 +02:00
Mario Heiderich
6023524787
chore: Modernized most of the demos to use actual ES6
2024-01-15 14:59:25 +01:00
Mario Heiderich
4018ebb968
fix: Updated the CSS sanitizer hook demo, thanks @Steb95
2024-01-15 13:27:35 +01:00
Cure53 and GitHub
285ffe0451
Update README.md
2023-11-20 08:38:45 +01:00
Issei Horie
0dde8c52bc
return removed hook
2022-03-06 20:42:14 +09:00
Issei Horie
17c065acbf
docs: fixed typo on README for demos
2021-12-18 00:40:57 +09:00
Mario Heiderich
862d266f6a
See #450
...
chore: changed several labels and comments
2020-06-24 13:45:54 +02:00
Mario Heiderich
edd8d4e184
fix: Hardened one of the demos for better leak-prevention
2020-06-08 18:42:38 +02:00
numirias
5bf17d708a
Fix advanced config demo
...
The advanced config demo incorrectly assigned `innerHTML` from a DOM node
instead of a string.
2020-06-08 02:15:05 +02:00
tdeekens
0dd9cd1623
chore: apply prettier to more
2020-04-19 19:43:37 +02:00
Mike Snare
a315ce6af8
Adding a new example for node removal
2020-01-31 08:08:32 -05:00
Krzysztof Kotowicz
a4dffb483c
Updated the demo and the code to the current version of the Trusted
...
Types API.
2019-11-05 17:02:32 +01:00
[Ar][Te]m.[Be][Rn][At]skyy and GitHub
1546398a9d
Fixed security issue in demo (Reverse Tabnabbing)
2019-05-15 06:45:40 +03:00
Dr.-Ing. Mario Heiderich
05bcdbec8a
Removed node8 tests, added node11 tests
2019-04-13 12:52:45 +02:00
Krzysztof Kotowicz
ac198770ef
Made the demo buttons work.
2018-10-31 18:39:15 +01:00
Krzysztof Kotowicz
24edc76bf3
Added support for Trusted Types.
...
DOMPurify detects if TrustedTypes are available. If so, will create an inner no-op policy, with a name 'dompurify', optionally suffixed with a value specified in a data-tt-policy-suffix attribute of the script using DOMPurify. It will use that policy when interacting with the (dirty) DOM, and will return a TrustedHTML object instead of a string.
See https://github.com/WICG/trusted-types .
2018-10-31 17:35:07 +01:00
Steven and GitHub
5a152cd33b
Add missing var
2018-09-29 21:13:47 -04:00
tdeekens and Cure53
93ed1a8892
Update demos to consume dist build
2017-05-25 09:47:55 +02:00
Ryan Lester
41fc612662
URI scheme whitelist demo hook regex fix
2017-02-24 19:35:18 -05:00
Gareth Heyes
e2527e640c
Updated mentaljs demo and library
...
Updated mental to latest version. Added parseInnerHTML function to
handle innerHTML assignments.
2016-09-14 20:43:53 +01:00
Cure53
a527039b64
Update README.md
2015-10-29 00:46:01 +09:00
Cure53
6097e3f464
Update README.md
2015-10-29 00:42:29 +09:00
Mario Heiderich
527d3a1c02
Cleaned up SVG demo hook
2015-10-28 23:58:36 +09:00
Olivier Paroz
c24dab6381
Create hooks-svg-demo.html
2015-10-25 23:44:09 +01:00
Olivier Paroz
990ecb3459
Adding an example on how to process SVGs
2015-10-25 23:06:34 +01:00
Mario Heiderich
33cbac8d5c
Formatted code in hooks and READMEs
2015-09-20 14:35:30 +02:00
suǝʞǝǝpʇ
0ae7ff4d4b
Fix using purify.js from /src folder in demos and index.tpl.
2015-09-17 20:47:17 +02:00
Mario Heiderich
91d4201484
Added basic CSS sanitizer
2015-08-04 14:57:00 +02:00
Cure53
71f4e2167c
Update README.md
2015-07-20 15:44:52 +02:00
Mario Heiderich
ff847d0a8c
Added more links to demo/hook README
2015-07-20 15:01:41 +02:00
Mario Heiderich
52e543e992
Added final hook descriptions
...
Added links to hook sources
2015-07-20 14:54:21 +02:00
Mario Heiderich
be1d6bab24
Added more demo README content
2015-07-20 14:43:54 +02:00
Mario Heiderich
6eefda2ef4
Enhanced the proxy hook CSS processing code
...
Tested on IE, Egde, Chrome and FF
Added a first demo overview page
2015-07-20 14:27:42 +02:00
Conrad Irwin
c97a57f1fe
Fix 'use strict'
2015-07-19 15:31:55 -07:00
Conrad Irwin
453632e30d
Fix DOM attributes
2015-07-19 15:12:11 -07:00
Conrad Irwin
5a71466813
Add CSS animations
2015-07-19 11:23:16 -07:00
Conrad Irwin
9d68e3f187
Add support for media queries
2015-07-19 11:07:50 -07:00
Conrad Irwin
14345be8ec
Handle @font-face
2015-07-19 10:19:17 -07:00
Mario Heiderich
f6107a0256
Optimized handling of CSS vars
...
Added test-cases for attr leaks and vars
Fixed a problem with empty selectors
2015-07-07 16:15:15 +02:00
Mario Heiderich
ea05499cfa
Refined test case a bit
2015-07-07 14:47:48 +02:00
Mario Heiderich
c607a2cd1e
Added testcase for @avlidienbrunn's bypass
2015-07-07 14:46:09 +02:00
Mario Heiderich
169747c75e
Seemingly fixed a mXSS issue on IE10,11 and Edge
...
Fixed a bypass spotted by @avlidienbrunn
2015-07-07 14:44:56 +02:00
Mario Heiderich
bad350dfc6
Added CSS element leak protection
...
Added better CSS rule rewriting
Added compatibility for FF, Chrome, IE and Spartan
Fixed an innerHTML security bug
Removed @import re-writing (XSS on IE)
Removed general support for @import rules (for now)
2015-07-07 13:29:06 +02:00
Conrad Irwin
e7a958b255
First pass at style tag sanitization
2015-07-06 10:39:56 -07:00
Mario Heiderich
9aaa7094b9
Fixed a comment typo
2015-07-06 11:15:01 +02:00
Mario Heiderich
2a0888ec93
Fixed the IE problem with reverse style attribute sorting
2015-07-04 01:11:34 +02:00
Mario Heiderich
4773a7f45b
Added a proxy hook element for inline CSS
...
TODO: Fix weird background CSS behavior on MSIE
2015-07-04 00:43:46 +02:00
Mario Heiderich
b60254917a
Added better config, made it leak-tight (but too restrictive for
...
production use, WIP)
2015-07-03 21:46:15 +02:00
