script_sanitizer.js

A simple npm library to remove script tags but keep other html

Installation

NPM: npm install script_sanitize
CDN: https://cdn.rawgit.com/eperegrine/script_sanitizer.js/master/dist/script_sanitize.min.js
Repo: dist/script_sanitize.js
Repo Minified: dist/script_sanitize.min.js

Documention

https://doclets.io/eperegrine/script_sanitizer.js/master

Usage

If on Node.js

const script_sanitize = require('../script_sanitize');
var sanitize = script_sanitize.sanitize;

If on a website

<script href="https://cdn.rawgit.com/eperegrine/script_sanitizer.js/master/dist/script_sanitize.min.js"></script>
<script type="text/javascript">
  var sanitize = script_sanitize.sanitize;
</script>

The method is defined as

sanitize(html, options (optional))

and can be used like so

var sanitized = sanitize("<h1>Hello</h1><script>alert('hi')</script>");
//=> <h1>Hello</h1>

var sanitizedWithReplacment = sanitize("<h1>Hello</h1><script>alert('hi')</script>", { replacementText: "no" });
//=> <h1>Hello</h1>no

Attributes

The default attributes are stored in an array which can be refrenced like:

var attrArray = script_sanitize.defaultAttributes;

and if you wanted to make an attribute exempt you could apply it like so

thanks stack overflow

var newAttrArray = script_sanitize.defaultAttributes;
var exemptIndex = newAttrArray.indexOf("onclick");
newAttrArray.splice(exmptIndex, 1);
sanitize("[HTML STUFF]", { attributes: newAttrArray });

The options parameter

Option	Description	Default Value
replacementText	The text to replace the script tag with	""
loop	Whether to replace via looping or a single statement	true
replaceEndTagsAfter	In certain cases the ending script tag is still there, this options ensures it won't be	true
tags	The tags that should be replaced	["script"]
attributes	The attributes that should be replaced	defaultAttributes

Utils

Util	Description
isDefined	Checks if a variable is defined
defaultFor	Sets a default value if a variable is defined
generateRegexForTag	Generates a regex object for a tag
generateRegexForEndTag	Generates a regex object to check an end tag
generateRegexForAttribute	Generates a regex object to check an attribute

License

MIT

Disclaimer

The code uses regex, which has been sourced from here The regex is: /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script\s*>/gi

Although this library will likely be used for security purposes I, the developer, am not responsible if this pacakge doesn't meet your security requirements so use with caution

eperegrine / script_sanitizer.js Goto Github PK