Commit Graph

Select branches

Hide Pull Requests

main

0.1

0.3

0.4

0.4.2

0.4.3

0.4.4

0.4.5

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.7.0

0.7.1

0.7.2

0.7.3

0.7.4

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.9.0

1.0.0

1.0.1

1.0.10

1.0.11

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

2.0.0

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.2.0

2.2.2

2.2.3

2.2.4

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0

2.3.1

2.3.10

2.3.11

2.3.12

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.8

2.3.9

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

3.0.0

3.0.1

3.0.10

3.0.11

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.3.0

3.3.1

3.3.2

3.3.3

3.4.0

3.4.1

3.4.10

3.4.11

3.4.12

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

v0.3

Mono Color

• 5c1fc95134 Merge pull request #83 from cure53/HTTPLeaks Cure53 2015-07-20 15:02:23 +02:00
• ff847d0a8c Added more links to demo/hook README Mario Heiderich 2015-07-20 15:01:41 +02:00
• 52e543e992 Added final hook descriptions Added links to hook sources Mario Heiderich 2015-07-20 14:54:21 +02:00
• be1d6bab24 Added more demo README content Mario Heiderich 2015-07-20 14:43:54 +02:00
• 6eefda2ef4 Enhanced the proxy hook CSS processing code Tested on IE, Egde, Chrome and FF Added a first demo overview page Mario Heiderich 2015-07-20 14:27:42 +02:00
• b0c9ee37c1 Merge pull request #82 from ConradIrwin/more-css Cure53 2015-07-20 12:48:57 +02:00
• c97a57f1fe Fix 'use strict' Conrad Irwin 2015-07-19 15:31:55 -07:00
• 453632e30d Fix DOM attributes Conrad Irwin 2015-07-19 15:12:11 -07:00
• 5a71466813 Add CSS animations Conrad Irwin 2015-07-19 11:23:16 -07:00
• 9d68e3f187 Add support for media queries Conrad Irwin 2015-07-19 10:41:14 -07:00
• 14345be8ec Handle @font-face Conrad Irwin 2015-07-19 10:19:17 -07:00
• f6107a0256 Optimized handling of CSS vars Added test-cases for attr leaks and vars Fixed a problem with empty selectors Mario Heiderich 2015-07-07 16:15:15 +02:00
• ea05499cfa Refined test case a bit Mario Heiderich 2015-07-07 14:47:48 +02:00
• c607a2cd1e Added testcase for @avlidienbrunn's bypass Mario Heiderich 2015-07-07 14:46:09 +02:00
• 169747c75e Seemingly fixed a mXSS issue on IE10,11 and Edge Fixed a bypass spotted by @avlidienbrunn Mario Heiderich 2015-07-07 14:44:56 +02:00
• bad350dfc6 Added CSS element leak protection Added better CSS rule rewriting Added compatibility for FF, Chrome, IE and Spartan Fixed an innerHTML security bug Removed @import re-writing (XSS on IE) Removed general support for @import rules (for now) Mario Heiderich 2015-07-07 13:29:06 +02:00
• 12657d39e5 Merge pull request #81 from ConradIrwin/HTTPLeaks Cure53 2015-07-07 10:10:34 +02:00
• e7a958b255 First pass at style tag sanitization Conrad Irwin 2015-07-06 10:32:31 -07:00
• 9aaa7094b9 Fixed a comment typo Mario Heiderich 2015-07-06 11:15:01 +02:00
• 2a0888ec93 Fixed the IE problem with reverse style attribute sorting Mario Heiderich 2015-07-04 01:11:34 +02:00
• 4773a7f45b Added a proxy hook element for inline CSS TODO: Fix weird background CSS behavior on MSIE Mario Heiderich 2015-07-04 00:43:46 +02:00
• b60254917a Added better config, made it leak-tight (but too restrictive for production use, WIP) Mario Heiderich 2015-07-03 21:46:15 +02:00
• 813457d086 Added experimentaly test case for HTTPLeaks evaluation Mario Heiderich 2015-07-03 21:31:47 +02:00
• 2abbbdc4e5 Added IE/Edge compatibility to demo hook Mario Heiderich 2015-06-29 23:24:17 +02:00
• 5237c1b6b8 Enhanced link handling for demo hook Enabled relative links to work Mario Heiderich 2015-06-29 22:41:35 +02:00
• 1f354365a0 Fixed another faulty comment Mario Heiderich 2015-06-29 22:02:08 +02:00
• 6afc18978e Fixed a faulty comment Mario Heiderich 2015-06-29 22:01:00 +02:00
• d94da415c2 Optimized the scheme whitelist hook a bit Mario Heiderich 2015-06-29 21:58:45 +02:00
• 8ac1a89019 Added demo hook for a URI scheme whitelist Mario Heiderich 2015-06-29 19:33:25 +02:00
• 6b0c682116 Add note about io.js/Node.js compatibility Frederic Hemberger 2015-06-16 22:11:09 +02:00
• e4fd6a1ca4 Merge pull request #79 from fastmail/contenttests Cure53 2015-06-15 19:19:37 +02:00
• 7a031e3232 Add a few other tags to exclude content for. Neil Jenkins 2015-06-15 14:59:24 +07:00
• 85b140ce92 Fix tests. Neil Jenkins 2015-06-15 14:38:01 +07:00
• 52462e595a Merge pull request #78 from fastmail/contentblacklist Cure53 2015-06-13 10:04:19 +02:00
• abd5151c4e Change CONTENT_TAGS to blacklist Neil Jenkins 2015-06-13 12:06:04 +07:00
• 31feb01946 Merge pull request #75 from dhardtke/master Frederic Hemberger 2015-06-09 08:28:01 +02:00
• d2dfb40246 fix stupid typo dhardtke 2015-06-09 00:35:32 +02:00
• 9f0db17f75 Avoid description being cut off on npmjs.com Frederic Hemberger 2015-06-05 07:40:17 +02:00
• fcd83f06b1 Merge pull request #73 from fastmail/fiximport Cure53 2015-06-03 16:36:21 +02:00
• 9aecfe3c05 Remove more unnecessary checks from _isClobbered Neil Jenkins 2015-06-03 10:56:51 +07:00
• 5bdc53c1c1 Fix importing nodes into documents in browsers w/ web components support Neil Jenkins 2015-06-03 09:57:23 +07:00
• 26856379b7 Fix check for id attribute. Neil Jenkins 2015-06-03 10:53:40 +07:00
• 98397d8ac5 Comment nodes can't be clobbered. Neil Jenkins 2015-06-03 09:55:22 +07:00
• 19389f3823 Cleanup white-space Neil Jenkins 2015-06-03 10:53:20 +07:00
• 539dce2b8b Merge pull request #72 from fastmail/cleandom Cure53 2015-06-02 20:36:30 +02:00
• 7d07b2299e Ensure document has blank web-components registry Neil Jenkins 2015-06-01 21:04:17 +07:00
• d8dea8e3a1 Merge pull request #68 from Joris-van-der-Wel/returnfragment2 Cure53 2015-06-02 15:27:55 +02:00
• 59e5d2e3ab sanitize() should not throw if the original document is clobbered _after_ DOMPurify has been instantiated Joris van der Wel 2015-06-01 13:34:11 +02:00
• 19dd457038 RETURN_DOM_IMPORT option Joris van der Wel 2015-06-01 13:32:33 +02:00
• 2d5a049ef6 Reordered SVG attributes in white-list Mario Heiderich 2015-05-30 15:13:49 +02:00
• 7a35c89bea Merge pull request #69 from dhardtke/master Cure53 2015-05-30 15:08:42 +02:00
• 08937b8721 Merge pull request #70 from fastmail/ffattributes Cure53 2015-05-30 15:07:58 +02:00
• 11d778e794 Fix checking attributes type in FF22-34. Neil Jenkins 2015-05-30 07:20:18 +07:00
• a2108f4f18 add 'offset' attribute for gradients of SVG elements dhardtke 2015-05-29 20:57:53 +02:00
• b5109df801 Merge pull request #66 from fastmail/clobberToStringFix Cure53 2015-05-29 13:31:10 +02:00
• 6f3a06cb04 Use instanceof instead of toString to check if attributes is clobbered Neil Jenkins 2015-05-29 18:02:52 +07:00
• 9027d1a967 RETURN_DOM_FRAGMENT option Joris van der Wel 2015-05-29 11:40:30 +02:00
• 691186e46e Merge pull request #64 from fastmail/clobber Cure53 2015-05-29 10:25:52 +02:00
• 2c0c887f56 Update _isClobbered to check currently required properties Neil Jenkins 2015-05-29 14:45:48 +07:00
• ce13fc95d6 Merge pull request #63 from ConradIrwin/legacy Cure53 2015-05-27 08:35:34 +02:00
• 421694eb75 Add a few more missing legacy attributes Conrad Irwin 2015-05-26 17:20:43 -07:00
• b8b3ab6530 Prepared 0.6.4 release 0.6.4 Mario Heiderich 2015-05-25 13:39:52 +02:00
• afcdb9c5e1 Merge pull request #60 from Joris-van-der-Wel/noglobals Cure53 2015-05-18 09:37:16 +02:00
• 04d7218f5c Merge pull request #59 from Joris-van-der-Wel/overridebuiltins Cure53 2015-05-17 20:41:14 +02:00
• 4006d4aa14 Typo Joris van der Wel 2015-05-17 14:32:25 +02:00
• b433d09301 Support setting up DOMPurify using a custom Window Joris van der Wel 2015-05-17 12:39:06 +02:00
• 52e70b2f39 Disable jshint "boss" option Joris van der Wel 2015-05-17 12:36:46 +02:00
• 01263acddb Prevent DOM clobbering on <form> elements Joris van der Wel 2015-05-15 22:15:30 +02:00
• bccaa13535 Merge pull request #58 from Joris-van-der-Wel/qunitcontains Cure53 2015-05-15 21:00:38 +02:00
• b2c2b53dff Improve logging for assert.contains Joris van der Wel 2015-05-15 20:43:56 +02:00
• 7d71ee4018 Merge pull request #57 from fastmail/allowedtagattribute Cure53 2015-05-07 09:36:25 +02:00
• 4381b55b40 Allow background, cellpadding and cellspacing attributes Neil Jenkins 2015-05-07 08:25:44 +07:00
• 8dd28cb927 Preserve contents of <o:p> tag Neil Jenkins 2015-05-07 08:20:11 +07:00
• 18863b37e4 Update Mental.js Cure53 2015-05-03 18:42:29 +02:00
• 6e50d3914e Update README.md Cure53 2015-04-29 17:27:28 +02:00
• 15c7f8442b Merge pull request #56 from fastmail/safaricrash Cure53 2015-04-28 18:59:27 +02:00
• e48919f81a Fix Safari crash sanitizing <img id="foo" name="bar"> Neil Jenkins 2015-04-28 13:45:55 +07:00
• 9aea707e61 Fix tests in Safari Neil Jenkins 2015-04-28 14:19:01 +07:00
• 9bc489c49f Fix lint errors and tidy formatting. Neil Jenkins 2015-04-28 13:48:10 +07:00
• e01a7f8ad1 Merge pull request #54 from fastmail/attributes Cure53 2015-04-24 09:41:33 +02:00
• c175cc9d7d Tidy, optimise & improve hook in _sanitizeAttributes Neil Jenkins 2015-04-24 14:04:06 +07:00
• c1aa9dd134 Added test before hook removal Mario Heiderich 2015-04-20 15:57:56 +02:00
• 753053b61d Added prototypic removeHook functionality Added removeHook demo Mario Heiderich 2015-04-19 14:34:34 +02:00
• 6cd4ef4f88 Added missing 0.6.3 text to demo index Mario Heiderich 2015-04-07 16:56:06 +02:00
• df25a9cb0b Preparing release 0.6.3 0.6.3 Mario Heiderich 2015-04-07 15:55:12 +02:00
• 258dfb59e5 Update README.md Cure53 2015-04-07 15:52:28 +02:00
• 450a9f207e Merge pull request #52 from fastmail/refine Cure53 2015-04-07 15:49:53 +02:00
• 7006637034 Add test for presence of isSupported property. Neil Jenkins 2015-04-06 14:48:33 +07:00
• daf539d9a9 Add regression test for RETURN_DOM with simple string. Neil Jenkins 2015-04-06 14:12:46 +07:00
• 9666bb753d Fix check for body/html node type in _initDocument Neil Jenkins 2015-04-06 11:59:13 +07:00
• 224f1e077f Move internal methods/variables out of sanitize closure. Neil Jenkins 2015-04-06 11:14:18 +07:00
• 606821ce01 Convert allowed tags/attr lists to lookup tables. Neil Jenkins 2015-04-06 11:05:49 +07:00
• b613530df1 Add isSupported property to DOMPurify. Neil Jenkins 2015-04-06 10:50:58 +07:00
• 3c066fd808 Fix conditions for shortcut return from sanitize Neil Jenkins 2015-04-06 10:48:00 +07:00
• cb5d32eb4c Fix documentation of dirty param type in sanitize Neil Jenkins 2015-04-06 10:46:44 +07:00
• 2123a669a8 Move check for safe string out of _initDocument. Neil Jenkins 2015-04-06 10:45:19 +07:00
• 0467cc86d8 Remove DEBUG_OUTPUT option. Neil Jenkins 2015-04-06 10:43:24 +07:00
• d7334c786b Remove pointless condition in keep content check. Neil Jenkins 2015-04-06 10:41:04 +07:00
• db1e32b563 Remove needless check for comment node type. Neil Jenkins 2015-04-06 10:40:13 +07:00
• 9faf67e2d5 Optimise regular expressions Neil Jenkins 2015-04-06 10:39:06 +07:00