sanitize now the preferred name over sanitizeXSS
This commit is contained in:
parent
d501579948
commit
27f5f0bd2d
@ -1,8 +1,8 @@
|
||||
Summary
|
||||
=======
|
||||
provides 2 functions in the module Text.HTML.SanitizeXSS
|
||||
* sanitizeXSS - filters html to prevent XSS attacks.
|
||||
* sanitizeBalance - same as sanitizeXSS but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page
|
||||
* sanitize - filters html to prevent XSS attacks.
|
||||
* sanitizeBalance - same as sanitize but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page
|
||||
|
||||
Use Case
|
||||
========
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
module Text.HTML.SanitizeXSS
|
||||
( sanitizeXSS
|
||||
( sanitize
|
||||
, sanitizeBalance
|
||||
, sanitizeXSS
|
||||
) where
|
||||
|
||||
import Text.HTML.TagSoup
|
||||
@ -15,6 +16,9 @@ import Codec.Binary.UTF8.String ( encodeString )
|
||||
import qualified Data.Map as Map
|
||||
|
||||
-- | santize the html to prevent XSS attacks. See README.md <http://github.com/gregwebs/haskell-xss-sanitize> for more details
|
||||
sanitize = sanitizeXSS
|
||||
|
||||
-- alias of sanitize function
|
||||
sanitizeXSS :: String -> String
|
||||
sanitizeXSS = renderTagsOptions renderOptions {
|
||||
optMinimize = \x -> x `elem` ["br","img"] -- <img><img> converts to <img />, <a/> converts to <a></a>
|
||||
|
||||
2
test.hs
2
test.hs
@ -8,4 +8,4 @@ test actual expected = do
|
||||
|
||||
main = do
|
||||
test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>"
|
||||
test (sanitizeXSS testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"
|
||||
test (sanitize testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user