{"id":21525292,"url":"https://github.com/superraytin/xss-filter","last_synced_at":"2025-12-12T04:19:56.800Z","repository":{"id":14054427,"uuid":"16757313","full_name":"superRaytin/xss-filter","owner":"superRaytin","description":"XSS (Cross-Site Script) Filter for Node.js \u0026 the browser, provides friendly, reliable XSS filter API for you.","archived":false,"fork":false,"pushed_at":"2016-04-28T07:25:22.000Z","size":55,"stargazers_count":20,"open_issues_count":2,"forks_count":15,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-24T01:11:52.353Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/superRaytin.png","metadata":{"files":{"readme":"README-CN.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-02-12T05:41:37.000Z","updated_at":"2023-12-14T06:19:50.000Z","dependencies_parsed_at":"2022-09-06T08:41:24.642Z","dependency_job_id":null,"html_url":"https://github.com/superRaytin/xss-filter","commit_stats":null,"previous_names":["superraytin/xssfilter"],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superRaytin%2Fxss-filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superRaytin%2Fxss-filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superRaytin%2Fxss-filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superRaytin%2Fxss-filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/superRaytin","download_url":"https://codeload.github.com/superRaytin/xss-filter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248126455,"owners_count":21051925,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-24T01:34:21.320Z","updated_at":"2025-12-12T04:19:56.722Z","avatar_url":"https://github.com/superRaytin.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xssFilter\n\u003e xssFilter 是一个 XSS (Cross-Site Script) 过滤器模块，提供了友好，可靠的 XSS 过滤 API，支持在 Node.js 和浏览器中使用。\n\n[![NPM version][npm-image]][npm-url] [![Downloads][downloads-image]][npm-url] [![Bower version][bower-image]][bower-url]\n\n[![xssfilter](https://nodei.co/npm/xssfilter.png)](https://npmjs.org/package/xssfilter)\n\n[npm-url]: https://npmjs.org/package/xssfilter\n[downloads-image]: http://img.shields.io/npm/dm/xssfilter.svg\n[npm-image]: http://img.shields.io/npm/v/xssfilter.svg\n[bower-url]:http://badge.fury.io/bo/xssFilter\n[bower-image]: https://badge.fury.io/bo/xssFilter.svg\n\n[API 文档](#matchstyletag)\n\n# 安装\n\n### NPM\n\n```\n$ npm install xssfilter\n```\n\n### Bower\n\n```\n$ bower install xssFilter\n```\n\n# 使用\n\n### Node.js\n\n```js\nvar xssFilter = require('xssfilter');\nvar xssfilter = new xssFilter();\n\nvar output = xssfilter.filter('\u003cdiv class=\"like\" ondblclick=\"takeme()\" onmousedown=\"mousedown()\"\u003esomething...\u003c/div\u003e');\n// output: \u003cdiv class=\"like\"\u003esomething...\u003c/div\u003e\n```\n\n### 浏览器\n\n```js\n\u003cscript src=\"./dist/xssFilter.js\"\u003e\u003c/script\u003e\n\u003cscript\u003e\n    var xssfilter = new xssFilter();\n    var output = xssfilter.filter('\u003cdiv class=\"like\" ondblclick=\"takeme()\" onmousedown=\"mousedown()\"\u003esomething...\u003c/div\u003e');\n    // output: \u003cdiv class=\"like\"\u003esomething...\u003c/div\u003e\n\u003c/script\u003e\n```\n\n#### 通过 [require.js](http://requirejs.org/) 调用\n\n```js\n\u003cscript src=\"require.js\"\u003e\u003c/script\u003e\n\u003cscript\u003e\n    define(function() {\n        var xssFilter = require('./dist/xssFilter.js');\n        var xssfilter = new xssFilter();\n\n        var output = xssfilter.filter('\u003cdiv class=\"like\" ondblclick=\"takeme()\" onmousedown=\"mousedown()\"\u003esomething...\u003c/div\u003e');\n        // output: \u003cdiv class=\"like\"\u003esomething...\u003c/div\u003e\n    });\n\u003c/script\u003e\n```\n\n#### 通过 [sea.js](http://seajs.org/) 调用\n\n```js\n\u003cscript src=\"sea.js\"\u003e\u003c/script\u003e\n\u003cscript\u003e\n    seajs.use('./dist/xssFilter.js', function(xssFilter){\n        var xssfilter = new xssFilter();\n\n        // \"\u003c\" to \u0026lt; \"\u003e\" to \u0026gt;\n        xssfilter.options('escape', true);\n\n        var output = xssfilter.filter('\u003cdiv class=\"like\" ondblclick=\"takeme()\" onmousedown=\"mousedown()\"\u003esomething...\u003c/div\u003e');\n        // output: \u0026lt;div class=\"like\"\u0026gt;something...\u0026lt;/div\u0026gt;\n    })\n\u003c/script\u003e\n```\n\n# 直观地效果\n\n测试 HTML：\n\n```html\n\u003cdiv class =\"like\" ondblclick= \"ondblclick(); return false;\" onmousedown=\"mousedown()\"\u003e\n\t\u003cdiv class=\"title\" title=\"I am a title!\" value = \"big\"\u003etitle\u003c/div\u003e\n\t\u003cdiv class=\"desc\" onsubmit=\"load()\"\u003edesc\u003c/div\u003e\n\t\u003cdiv\u003ejust a div\u003c/div\u003e\n\t\u003cstyle type=\"text\"\u003e\n\t\t.red{color: #f00}\n\t\u003c/style\u003e\n\t\u003cscript\u003ealert(88)\u003c/script\u003e\n\u003c/div\u003e\n\u003cscript\u003ealert(99)\u003c/script\u003e\n```\n\n处理之后：\n\n```html\n\u003cdiv class=\"like\"\u003e\n\t\u003cdiv class=\"title\" title=\"I am a title!\" value=\"big\"\u003etitle\u003c/div\u003e\n\t\u003cdiv class=\"desc\"\u003edesc\u003c/div\u003e\n\t\u003cdiv\u003ejust a div\u003c/div\u003e\n\u003c/div\u003e\n```\n\n# 配置选项\n\n### matchStyleTag\n\n是否匹配 `style` 标签，默认会把匹配到的 `style` 标签删除，设置为 `false` 阻止删除\n\n### matchScriptTag\n\n是否匹配 `script` 标签，默认会把匹配到的 `script` 标签删除，设置为 `false` 阻止删除\n\n### removeMatchedTag\n\n是否要删除匹配到的标签，默认删除，如果设置为 `false`，则对标签进行转义\n\n`removeMatchedTag` 需要与 `matchStyleTag`、`matchScriptTag` 配合使用，比如:\n\n```js\nvar xssfilter = new xssFilter({\n    removeMatchedTag: false\n});\n```\n\n```html\n\u003cdiv class =\"like\" onmousedown=\"mousedown()\"\u003e\n\t\u003cstyle type=\"text\"\u003e\n\t\t.red{color: #f00}\n\t\u003c/style\u003e\n\tsomething...\n\u003c/div\u003e\n\u003cscript\u003ealert(88)\u003c/script\u003e\n```\n\n结果:\n\n```html\n\u003cdiv class=\"like\"\u003e\n\t\u0026lt;style type=\"text\"\u0026gt;\n\t\t.red{color: #f00}\n\t\u0026lt;/style\u0026gt;\n\tsomething...\n\u003c/div\u003e\n\u0026lt;script\u0026gt;alert(88)\u0026lt;/script\u0026gt;\n```\n\n### blackListAttrs\n\n标签属性黑名单列表，在这个列表中的属性将被清除\n\nblackListAttrs 的初始值列表：\n\n```js\n{\n    onclick: true,\n    ondblclick: true,\n    onchange: true,\n    onblur: true,\n    onfocus: true,\n    onkeydown: true,\n    onkeypress: true,\n    onkeyup: true,\n    onmousedown: true,\n    onmousemove: true,\n    onmouseover: true,\n    onmouseout: true,\n    onmouseup: true,\n    onselect: true,\n    onsubmit: true,\n    onreset: true,\n    onload: true,\n    onabort: true,\n    onerror: true\n}\n```\n\n### escape\n\n是否对整个字符串进行转义，默认不转义\n\n# 初始化\n\n创建一个 `xssFilter` 实例：\n\n```js\nvar xssfilter = new xssFilter(options);\n```\n\n构造函数方法中的 `options` 参数是可选的，传入需要的自定义配置，可以覆盖默认的配置选项。\n\n# 实例方法\n\n### filter\n过滤目标字符串的方法，仅接受一个参数\n\n### options\n\n配置选项除了可以在初始化时传入参数指定，也可以使用 `options` 方法来修改：\n\n```js\nvar xssfilter = new xssFilter();\n\nxssfilter.options({\n    escape: true,\n    matchStyleTag: false\n});\n\nvar output = xssfilter.filter('some html...');\n```\n\n当然也可以配置单个选项，下面这段代码输出的 HTML 中的标签将会被转义\n\n```js\nvar xssfilter = new xssFilter();\nxssfilter.options('escape', true);\nvar output = xssfilter.filter('some html...');\n```\n\n对于二级配置比如 `blackListAttrs`，第二个参数则必须是一个 `{}` 对象：\n\n```js\nvar xssfilter = new xssFilter();\n\nxssfilter.options('blackListAttrs', {\n    onsubmit: false\n});\n\nvar output = xssfilter.filter('\u003cdiv class=\"like\" ondblclick=\"ondblclick();\" onsubmit=\"dosomething()\"\u003esomething...\u003c/div\u003e');\n// output: \u003cdiv class=\"like\" onsubmit=\"dosomething()\"\u003esomething...\u003c/div\u003e\n```\n\n# Test case\n\n```\nnpm test\n```\n\n# 其他预防 XSS 的库\n\n- [https://github.com/leizongmin/js-xss](https://github.com/leizongmin/js-xss)\n- [https://github.com/yahoo/xss-filters](https://github.com/yahoo/xss-filters)\n\n# License\nMIT, see the [LICENSE](https://github.com/superRaytin/xssFilter/blob/master/LICENSE) file for detail.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperraytin%2Fxss-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsuperraytin%2Fxss-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperraytin%2Fxss-filter/lists"}