haskell/xss-sanitize
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sanitize now the preferred name over sanitizeXSS

Browse Source
This commit is contained in:
Greg Weber 2010-11-01 16:27:03 -07:00
parent d501579948
commit 27f5f0bd2d
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -1,8 +1,8 @@
Summary Summary
======= =======
provides 2 functions in the module Text.HTML.SanitizeXSS provides 2 functions in the module Text.HTML.SanitizeXSS
* sanitizeXSS - filters html to prevent XSS attacks. * sanitize - filters html to prevent XSS attacks.
* sanitizeBalance - same as sanitizeXSS but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page * sanitizeBalance - same as sanitize but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page
Use Case Use Case
======== ========

6
Text/HTML/SanitizeXSS.hs
View File

@ -1,6 +1,7 @@
module Text.HTML.SanitizeXSS module Text.HTML.SanitizeXSS
( sanitizeXSS ( sanitize
, sanitizeBalance , sanitizeBalance
, sanitizeXSS
) where ) where
import Text.HTML.TagSoup import Text.HTML.TagSoup
@ -15,6 +16,9 @@ import Codec.Binary.UTF8.String ( encodeString )
import qualified Data.Map as Map import qualified Data.Map as Map
-- | santize the html to prevent XSS attacks. See README.md <http://github.com/gregwebs/haskell-xss-sanitize> for more details -- | santize the html to prevent XSS attacks. See README.md <http://github.com/gregwebs/haskell-xss-sanitize> for more details
sanitize = sanitizeXSS
-- alias of sanitize function
sanitizeXSS :: String -> String sanitizeXSS :: String -> String
sanitizeXSS = renderTagsOptions renderOptions { sanitizeXSS = renderTagsOptions renderOptions {
optMinimize = \x -> x `elem` ["br","img"] -- <img><img> converts to <img />, <a/> converts to <a></a> optMinimize = \x -> x `elem` ["br","img"] -- <img><img> converts to <img />, <a/> converts to <a></a>

2
test.hs
View File

@ -8,4 +8,4 @@ test actual expected = do
main = do main = do
test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>" test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>"
test (sanitizeXSS testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">" test (sanitize testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"