sanitize now the preferred name over sanitizeXSS

This commit is contained in:
Greg Weber 2010-11-01 16:27:03 -07:00
parent d501579948
commit 27f5f0bd2d
3 changed files with 8 additions and 4 deletions

View File

@ -1,8 +1,8 @@
Summary
=======
provides 2 functions in the module Text.HTML.SanitizeXSS
* sanitizeXSS - filters html to prevent XSS attacks.
* sanitizeBalance - same as sanitizeXSS but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page
* sanitize - filters html to prevent XSS attacks.
* sanitizeBalance - same as sanitize but makes sure there are no lone closing tags - this could prevent a user's html from messing up your page
Use Case
========

View File

@ -1,6 +1,7 @@
module Text.HTML.SanitizeXSS
( sanitizeXSS
( sanitize
, sanitizeBalance
, sanitizeXSS
) where
import Text.HTML.TagSoup
@ -15,6 +16,9 @@ import Codec.Binary.UTF8.String ( encodeString )
import qualified Data.Map as Map
-- | santize the html to prevent XSS attacks. See README.md <http://github.com/gregwebs/haskell-xss-sanitize> for more details
sanitize = sanitizeXSS
-- alias of sanitize function
sanitizeXSS :: String -> String
sanitizeXSS = renderTagsOptions renderOptions {
optMinimize = \x -> x `elem` ["br","img"] -- <img><img> converts to <img />, <a/> converts to <a></a>

View File

@ -8,4 +8,4 @@ test actual expected = do
main = do
test (sanitizeBalance testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced<div></div><img src=\"http://safe.com\"></b>"
test (sanitizeXSS testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"
test (sanitize testHTML) " <a href=\"http://safe.com\">safe</a><a>anchor</a> <img /> <br /> <b>Unbalanced</div><img src=\"http://safe.com\">"