TypeScript sanitize-html類代碼示例

import * as sanitize from 'sanitize-html';

let options: sanitize.IOptions = {
  allowedTags: sanitize.defaults.allowedTags.concat('h1', 'h2', 'img'),
  allowedAttributes: {
    'a': sanitize.defaults.allowedAttributes['a'].concat('rel'),
    'img': ['src', 'height', 'width', 'alt']
  },
	transformTags: { 
    'a': sanitize.simpleTransform('a', { 'rel': 'nofollow' }),
    'img': (tagName: string, attribs: sanitize.Attributes) => {
      let img = { tagName, attribs };
      img.attribs['alt'] = 'transformed' ;
      return img;
    }
  },
  exclusiveFilter: function(frame: sanitize.IFrame) {
    return frame.tag === 'a' && !frame.text.trim();
  },
  allowedSchemesByTag: {
    'a': ['http', 'https']
  },
  allowProtocolRelative: false
};

let unsafe = '<div><script>alert("hello");</script></div>';

let safe = sanitize(unsafe, options);

	/**
	 * Checks the value stored to see if its correct in its current form
	 */
    public validate(): Promise<boolean | Error> {
        const transformedValue = this.value;
        const toRemove: number[] = [];
        for ( let i = 0, l = transformedValue.length; i < l; i++ ) {
            transformedValue[ i ] = sanitizeHtml( transformedValue[ i ].trim(), { allowedTags: [] } );

            if ( transformedValue[ i ].trim() === '' )
                toRemove.push( i );
        }

        // Remove any '' cells
        for ( let i = toRemove.length - 1; i >= 0; i-- )
            transformedValue.splice( toRemove[ i ], 1 );

        const maxCharacters = this.maxCharacters;
        const minCharacters = this.minCharacters;


        if ( transformedValue.length < this.minItems )
            return Promise.reject<Error>( new Error( `You must select at least ${this.minItems} item${( this.minItems === 1 ? '' : 's' )} for ${this.name}` ) );
        if ( transformedValue.length > this.maxItems )
            return Promise.reject<Error>( new Error( `You have selected too many items for ${this.name}, please only use up to ${this.maxItems}` ) );

        for ( let i = 0, l = transformedValue.length; i < l; i++ ) {
            transformedValue[ i ] = transformedValue[ i ].trim();
            if ( transformedValue[ i ].length > maxCharacters )
                return Promise.reject<Error>( new Error( `The character length of '${transformedValue[ i ]}' in ${this.name} is too long, please keep it below ${maxCharacters}` ) );
            else if ( transformedValue[ i ].length < minCharacters )
                return Promise.reject<Error>( new Error( `The character length of '${transformedValue[ i ]}' in ${this.name} is too short, please keep it above ${minCharacters}` ) );
        }

        return Promise.resolve( true );
    }

export function strictSanitize(value: string) {
    const config = {
        allowedAttributes: {},
        allowedTags: [] as string[],
        textFilter(text: string) {
            return text.replace(/"/g, '"');
        },
    };

    return sanitizeHtml(value, config);
}

export function tolerantSanitize(value: string) {
    const config = {
        allowedAttributes: {
            a: ['href'],
        },
        allowedSchemes: ['http', 'https', 'mailto'],
        allowedTags: ['b', 'i', 'em', 'strong', 'a', 'p'],
        textFilter(text: string) {
            return text.replace(/"/g, '"');
        },
    };

    return sanitizeHtml(value, config);
}

export function sanitize(
  html: string,
  opts: IOptions,
  overrideOpts: (opts: sanitizeHTML.IOptions) => sanitizeHTML.IOptions,
): string {
  let sanitizeHTMLOpts = defaultSanitizeHTMLOptions as sanitizeHTML.IOptions;

  // Apply ting options
  opts = opts || {};
  sanitizeHTMLOpts.exclusiveFilter = (frame: sanitizeHTML.IFrame): boolean => {
    if (frame.attribs.id) {
      // id attribute is not allowed unless opts.idFilter returns true
      return opts.idFilter ? !opts.idFilter(frame.attribs.id as string) : true;
    }
    return false;
  };

  if (overrideOpts) {
    sanitizeHTMLOpts = overrideOpts(sanitizeHTMLOpts);
  }

  return sanitizeHTML(html, sanitizeHTMLOpts);
}

export const sanitize = (arg: string) => {
  return sanitize_(arg, { allowedTags });
};