<commit_before>/**
 * 过滤XSS攻击
 *
 * @author 老雷<<EMAIL>>
 */

/*
 * 默认HTML标签白名单
 * 标签名=>属性列表
 */
var defaultWhiteList = {
  h1:     ['style', 'class'],
  h2:     ['style', 'class'],
  h3:     ['style', 'class'],
  h4:     ['style', 'class'],
  h5:     ['style', 'class'],
  hr:     ['style', 'class'],
  span:   ['style', 'class'],
  strong: ['style', 'class'],
  b:      ['style', 'class'],
  i:      ['style', 'class'],
  br:     [],
  p:      ['style', 'class'],
  pre:    ['style', 'class'],
  code:   ['style', 'class'],
  a:      ['style', 'class', 'target', 'href', 'title'],
  img:    ['style', 'class', 'src', 'alt', 'title'],
  div:    ['style', 'class'],
  table:  ['style', 'class', 'width', 'border'],
  tr:     ['style', 'class'],
  td:     ['style', 'class', 'width', 'colspan'],
  th:     ['style', 'class', 'width', 'colspan'],
  tbody:  ['style', 'class'],
  ul:     ['style', 'class'],
  li:     ['style', 'class'],
};

/**
 * 过滤属性值
 */
var defaultOnTagAttr = function (tag, attr, value) {
  if (attr === 'href' || attr === 'src') {
    if (/\/\*|\*\//mg.test(value)) {
      return '#';
    }
    if (/^[\s"'`]*((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a):/ig.test(value)) {
      return '#';
    }
  } else if (attr === 'style') {
    if (/\/\*|\*\//mg.test(value)) {
      return '#';
    }
    if (/((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a):/ig.test(value)) {
      return '';
    }
  }
};

/**
 * XSS过滤
 *
 * @param {string} html 要过滤的HTML代码
 * @param {object} whiteList 白名单，若不指定，则使用默认的
 * @param {function} onTagAttr 指定此回调用于处理属性值，格式：function (tagName, attrName, attrValue)
 *                             若要改变该值，返回新的值即可，否则不用返回任何值
 * @return {string}
 */
var xss = module.exports = function (html, whiteList, onTagAttr) {
  'use strict';

  if (typeof(whiteList) === 'function') {
    onTagAttr = whiteList;
    whiteList = defaultWhiteList;
  } else {
    whiteList = whiteList || exports.whiteList;
    onTagAttr = onTagAttr || exports.onTagAttr;
  }

  var rethtml = '';
  var lastPos = 0;
  var tagStart = false;
  var quoteStart = false;

  /**
   * 转换<>为&lt; &gt
   */
  var noTag = function (text) {
    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
  };

  /**
   * 过滤不合法的属性
   */
  var filterAttributes = function (tagName, attrs) {
    tagName = tagName.toLowerCase();
    var whites = whiteList[tagName];
    var lastPos = 0;
    var _attrs = [];<commit_msg>Update index.js<commit_after>/**
 * 过滤XSS攻击
 *
 * @author 老雷<<EMAIL>>
 */

/*
 * 默认HTML标签白名单
 * 标签名=>属性列表
 */
var defaultWhiteList = {
  h1:     ['style', 'class'],
  h2:     ['style', 'class'],
  h3:     ['style', 'class'],
  h4:     ['style', 'class'],
  h5:     ['style', 'class'],
  hr:     ['style', 'class'],
  span:   ['style', 'class'],
  strong: ['style', 'class'],
  b:      ['style', 'class'],
  i:      ['style', 'class'],
  br:     [],
  p:      ['style', 'class'],
  pre:    ['style', 'class'],
  code:   ['style', 'class'],
  a:      ['style', 'class', 'target', 'href', 'title'],
  img:    ['style', 'class', 'src', 'alt', 'title'],
  div:    ['style', 'class'],
  table:  ['style', 'class', 'width', 'border'],
  tr:     ['style', 'class'],
  td:     ['style', 'class', 'width', 'colspan'],
  th:     ['style', 'class', 'width', 'colspan'],
  tbody:  ['style', 'class'],
  ul:     ['style', 'class'],
  li:     ['style', 'class'],
  em:     ['style'],    //added by jim
  cite:   ['style']     //added by jim
};

/**
 * 过滤属性值
 */
var defaultOnTagAttr = function (tag, attr, value) {
  if (attr === 'href' || attr === 'src') {
    if (/\/\*|\*\//mg.test(value)) {
      return '#';
    }
    if (/^[\s"'`]*((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a):/ig.test(value)) {
      return '#';
    }
  } else if (attr === 'style') {
    if (/\/\*|\*\//mg.test(value)) {
      return '#';
    }
    if (/((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a):/ig.test(value)) {
      return '';
    }
  }
};

/**
 * XSS过滤
 *
 * @param {string} html 要过滤的HTML代码
 * @param {object} whiteList 白名单，若不指定，则使用默认的
 * @param {function} onTagAttr 指定此回调用于处理属性值，格式：function (tagName, attrName, attrValue)
 *                             若要改变该值，返回新的值即可，否则不用返回任何值
 * @return {string}
 */
exports = module.exports = function (html, whiteList, onTagAttr) {
  'use strict';

  if (typeof(whiteList) === 'function') {
    onTagAttr = whiteList;
    whiteList = defaultWhiteList;
  } else {
    whiteList = whiteList || exports.whiteList;
    onTagAttr = onTagAttr || exports.onTagAttr;
  }

  var rethtml = '';
  var lastPos = 0;
  var tagStart = false;
  var quoteStart = false;

  /**
   * 转换<>为&lt; &gt
   */
  var noTag = function (text) {
    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
  };

  /**
   * 过滤不合法的属性
   */
  var filterAttributes = function (tagName, attrs) {
    tagName = tagName.toLowerCase();
    var whites = whiteList[tagName];
    var lastPos = 0;
    var _attrs = [];
{'fraction_non_alphanumeric': 0.251984126984127, 'fraction_numerical': 0.002777777777777778, 'mean_word_length': 2.618808327351041, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1928054', 'n_tokens_mistral': 2189, 'n_tokens_neox': 2249, 'n_words': 404}