haskell/xss-sanitize
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

filtering was crashing on relative URIs

Browse Source 
relative URIs should be pass through fine
This commit is contained in:
Greg Weber 2010-11-26 17:06:46 -08:00
parent 5f2edf8f92
commit 73b4d57d61
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Text/HTML/SanitizeXSS.hs
View File

@ -76,7 +76,8 @@ safeAttribute (name, value) = name `member` sanitaryAttributes &&
sanitaryURI :: String -> Bool sanitaryURI :: String -> Bool
sanitaryURI u = sanitaryURI u =
case parseURIReference (escapeURI u) of case parseURIReference (escapeURI u) of
Just p -> (init (map toLower $ uriScheme p)) `member` safeURISchemes Just p -> (null (uriScheme p)) ||
((map toLower $ init $ uriScheme p) `member` safeURISchemes)
Nothing -> False Nothing -> False

2
test.hs
View File

@ -9,3 +9,5 @@ test actual expected = do
main = do main = do
test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>" test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>"
test (sanitize testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">" test (sanitize testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"
let testRelativeURI = "<a href=\"foo\">bar</a>"
test (sanitize testRelativeURI) testRelativeURI

2
xss-sanitize.cabal
View File

@ -1,5 +1,5 @@
name: xss-sanitize name: xss-sanitize
version: 0.2.3 version: 0.2.4
license: BSD3 license: BSD3
license-file: LICENSE license-file: LICENSE
author: Greg Weber <greg@gregweber.info> author: Greg Weber <greg@gregweber.info>