Created
February 16, 2020 03:21
-
-
Save abhaybhargav/aa529f016e12b38d2e2919dbaa6d190c to your computer and use it in GitHub Desktop.
Example of DOMPurify
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <html> | |
| <head> | |
| <title>Output Escaping Demo</title> | |
| <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.0.8/purify.min.js"></script> | |
| </head> | |
| <body> | |
| <script> | |
| //Filter for Anchor HREF | |
| var dirtyHref = 'javascript:alert(1)'; | |
| var link = document.createElement('a'); | |
| link.setAttribute('href', dirtyHref); | |
| link.innerText = "Click me if you want to live!"; | |
| var cleanLink = DOMPurify.sanitize(link, {IN_PLACE: true}); | |
| console.log(cleanLink); | |
| document.body.appendChild(cleanLink); | |
| //Filter for onmousedown event | |
| var dirtyJS = 'alert(1)'; | |
| var para = document.createElement('p'); | |
| para.setAttribute('onmousedown', dirtyJS); | |
| para.innerText = "I am a paragraph. Click on me!"; | |
| var cleanPara = DOMPurify.sanitize(para, {IN_PLACE: true}); | |
| console.log(cleanPara); | |
| document.body.appendChild(cleanPara); | |
| </script> | |
| </body> | |
| </html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment