mirror of
https://github.com/hanzoai/DOMPurify.git
synced 2026-09-24 16:55:05 +00:00
db4b93a1c0
* Update README.md * build(deps): bump qs and body-parser (#1178) Bumps [qs](https://github.com/ljharb/qs) and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.13.0...v6.14.1) Updates `body-parser` from 1.20.3 to 1.20.4 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](https://github.com/expressjs/body-parser/compare/1.20.3...1.20.4) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect - dependency-name: body-parser dependency-version: 1.20.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: update tested nodejs version (#1181) Test currently supported nodejs versions. Drop: 18, 19, 21, 23 Add: 24, 25 * chore: update dependencies (#1183) - migrate to official rollup plugin `@rollup/plugin-typescript` from `rollup-plugin-typescript2` - migrate to `rimraf` v6 * Revert "chore: update dependencies (#1183)" (#1184) This reverts commit 50f6dfe864c58f377afdbd0d597bf3f7572ffc6d. * fix: remove deprecated call `QUnit.load()` (#1188) This is no longer needed since QUnit 2.1.1, and the call to QUnit.load() is safe to remove. https://qunitjs.com/api/QUnit/load/ * fix: prettier windows end of line not lf (#1186) * remove abandoned dependency `npm-run-all` (#1190) * remove dependency `lodash.sample` (#1191) use native code * build(deps-dev): bump lodash-es from 4.17.21 to 4.17.23 (#1192) Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash-es dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump lodash from 4.17.21 to 4.17.23 (#1193) Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update README.md (#1195) * build(deps-dev): bump webpack from 5.94.0 to 5.105.0 (#1194) Bumps [webpack](https://github.com/webpack/webpack) from 5.94.0 to 5.105.0. - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](https://github.com/webpack/webpack/compare/v5.94.0...v5.105.0) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.105.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update README.md * Update README.md * build(deps): bump qs from 6.14.1 to 6.14.2 (#1196) Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.14.2. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: Added smaller fixes addressing several LLM bug reports * fix: Adding a slighjtly tighter regex because of possible jsdom woes * build(deps-dev): bump minimatch from 3.1.2 to 3.1.5 (#1200) Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump rollup from 3.29.5 to 3.30.0 (#1199) Bumps [rollup](https://github.com/rollup/rollup) from 3.29.5 to 3.30.0. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v3.30.0/CHANGELOG.md) - [Commits](https://github.com/rollup/rollup/compare/v3.29.5...v3.30.0) --- updated-dependencies: - dependency-name: rollup dependency-version: 3.30.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: Adding a slightly tighter regex because of possible jsdom woes * fix: Expanded the regex ever so slightly to also cover script * build(deps): bump @tootallnate/once and jsdom (#1204) Removes [@tootallnate/once](https://github.com/TooTallNate/once). It's no longer used after updating ancestor dependency [jsdom](https://github.com/jsdom/jsdom). These dependencies need to be updated together. Removes `@tootallnate/once` Updates `jsdom` from 20.0.0 to 28.1.0 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Changelog](https://github.com/jsdom/jsdom/blob/main/Changelog.md) - [Commits](https://github.com/jsdom/jsdom/compare/20.0.0...28.1.0) --- updated-dependencies: - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect - dependency-name: jsdom dependency-version: 28.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: Preparing 3.3.2 release * fix: moved back from jsdom 28 to jsdom 20 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rotzbua <[email protected]>
92 lines
5.2 KiB
HTML
92 lines
5.2 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>DOMPurify 3.3.2 "Seraphina"</title>
|
|
<script src="../dist/purify.min.js"></script>
|
|
<!-- we don't actually need it - just to demo and test the $(html) sanitation -->
|
|
<script src="//code.jquery.com/jquery-3.2.0.min.js"></script>
|
|
<script>
|
|
if(typeof console === 'undefined') {console={}; console.log=function(){}}
|
|
window.onload = function(){
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open('GET', 'https://cdn.rawgit.com/cure53/DOMPurify/main/test/fixtures/expect.mjs');
|
|
xhr.onload = function(){
|
|
var data=JSON.parse(xhr.responseText.slice(15, -1));
|
|
x.value = '<!-- I am ready now, click one of the buttons! -->\r\n';
|
|
for(var i in data) {
|
|
x.value+=data[i].payload+"\r\n\r\n";
|
|
}
|
|
}
|
|
xhr.send(null);
|
|
}
|
|
</script>
|
|
</head>
|
|
<body>
|
|
<h4>DOMPurify 3.3.2 "Seraphina"</h4>
|
|
<p>
|
|
<a href="http://badge.fury.io/js/dompurify" rel="nofollow"><img alt="npm version" src="https://badge.fury.io/js/dompurify.svg"></a>
|
|
<a target="_blank" rel="noopener noreferrer" href="https://github.com/cure53/DOMPurify/workflows/Build%20and%20Test/badge.svg?branch=main"><img src="https://github.com/cure53/DOMPurify/workflows/Build%20and%20Test/badge.svg?branch=main" alt="Build and Test"></a>
|
|
<a href="https://www.npmjs.com/package/dompurify" rel="nofollow"><img alt="Downloads" src="https://img.shields.io/npm/dm/dompurify.svg"></a>
|
|
<a href="https://cdn.jsdelivr.net/npm/dompurify/dist/purify.min.js" rel="nofollow"><img alt="minified size" src="https://badgen.net/bundlephobia/min/dompurify?color=green&label=minified"></a>
|
|
<a href="https://packagephobia.now.sh/result?p=dompurify" rel="nofollow"><img alt="gzip size" src="https://badgen.net/bundlephobia/minzip/dompurify?color=green&label=gzipped"></a>
|
|
<a href="https://github.com/cure53/DOMPurify/network/dependents"><img alt="dependents" src="https://badgen.net/github/dependents-repo/cure53/dompurify?color=green&label=dependents"></a></p>
|
|
<p>
|
|
<p>
|
|
This is the demo for <a href="https://github.com/cure53/DOMPurify">DOMPurify</a>, a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, SVG and MathML.
|
|
The textarea below contains sample-payload - you can also add your own. Watch it sanitize on the console or in the Iframe below.
|
|
</p>
|
|
<hr>
|
|
<button onclick="
|
|
var tx1 = Date.now();
|
|
var xss = DOMPurify.sanitize(x.value);
|
|
console.info('Operation took ' + (t=Date.now()-tx1) + ' milliseconds to complete.');
|
|
console.log(xss.toString());
|
|
y.value=xss;
|
|
timing.innerHTML=t+'ms '+timing.innerHTML
|
|
">Sanitize textarea value, then write result to console</button>
|
|
<button onclick="
|
|
var ifr = document.getElementById('ifr');
|
|
var tx1 = Date.now();
|
|
var xss = DOMPurify.sanitize(x.value);
|
|
console.info('Operation took ' + (t=Date.now()-tx1) + ' milliseconds to complete.');
|
|
ifr.contentDocument.open();
|
|
ifr.contentDocument.write(xss.toString());
|
|
y.value=xss;
|
|
ifr.contentDocument.close();
|
|
timing.innerHTML=t+'ms '+timing.innerHTML
|
|
">Sanitize textarea value, then write result to DOM</button>
|
|
<label for="auto">Auto convert?</label><input type="checkbox" id="auto">
|
|
<button title="This might not work with the large default payload. Better try with smaller, realistic values" onclick="
|
|
var ifr = document.getElementById('ifr');
|
|
var tx1 = Date.now();
|
|
var xss = DOMPurify.sanitize(x.value);
|
|
console.info('Operation took ' + (t=Date.now()-tx1) + ' milliseconds to complete.');
|
|
$(ifr.contentDocument.body).html(xss.toString());
|
|
y.value=$(ifr.contentDocument.body).html();
|
|
ifr.contentDocument.close();
|
|
timing.innerHTML=t+'ms '+timing.innerHTML
|
|
">Sanitize textarea value, then use $(elm).html()</button>
|
|
<hr>
|
|
<p>
|
|
Timings: <code id="timing"> </code>
|
|
</p>
|
|
<p><label for="x">Dirty HTML</label></p>
|
|
<textarea onkeyup="
|
|
if(!document.getElementById('auto').checked) {
|
|
return;
|
|
}
|
|
var ifr = document.getElementById('ifr');
|
|
var xss = DOMPurify.sanitize(x.value);
|
|
ifr.contentDocument.open();
|
|
ifr.contentDocument.write(xss.toString());
|
|
y.value=xss;
|
|
ifr.contentDocument.close();
|
|
" placeholder="Payload goes here, test me, test me hard!" id="x" style="width:95%;height:100px"><!-- Loading Test-Vectors ... --></textarea>
|
|
<p><label for="y">Clean HTML</label></p>
|
|
<textarea placeholder="Here be the sanitized markup to inspect!" id="y" style="width:95%;height:100px"></textarea>
|
|
<p><label for="ifr">Clean DOM</label></p>
|
|
<iframe src="about:blank" id="ifr" style="width:95%;height:100px"></iframe>
|
|
</body>
|
|
</html>
|