From 67b2a0cfefb9aecf04dc46a689c22415ceecd80e Mon Sep 17 00:00:00 2001 From: adon Date: Thu, 12 Mar 2015 17:13:49 +0800 Subject: [PATCH 1/2] publish as release v1.0.6 - improved speed of yubl() based on http://jsperf.com/lazy-regexp-parsing - added grave accent ` handling in y() and yavu() - code cleanup to shrink space --- README.md | 14 ++-- dist/xss-filters.1.0.6.min.js | 5 ++ dist/xss-filters.js | 4 +- dist/xss-filters.min.js | 4 +- package.json | 2 +- src/xss-filters.js | 49 +++++--------- tests/unit/private-xss-filters.js | 66 ++++-------------- tests/unit/xss-filters.js | 107 +++++++++++++++++------------- tests/utils.js | 18 ++++- 9 files changed, 122 insertions(+), 147 deletions(-) create mode 100644 dist/xss-filters.1.0.6.min.js diff --git a/README.md b/README.md index 33f8bfb..7f6b988 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ Secure XSS Filters `document.write("" + xssFilters.uriInHTMLData(url) + "");` - In this example, the traditional wisdom of blindly escaping the five well-known characters (`&` `<` `>` `'` `"`) would not stop XSS (e.g., when `url` is equal to `javascript:alert(1)` or ` onclick=alert(1)`). + In this example, the traditional wisdom of blindly escaping the five well-known characters (`&` `<` `>` `'` `"` `` ` ``) would not stop XSS (e.g., when `url` is equal to `javascript:alert(1)` or ` onclick=alert(1)`). - **Just Sufficient Encoding.** Encode the *minimal* set of characters to thwart JavaScript executions, thus preventing XSS attacks while keeping most characters intact. Say goodbye to double-encoding problems such as '&amp;lt;', as often resulted from traditional filters!! @@ -47,6 +47,8 @@ app.get('/', function(req, res){ Simply download the latest minified version from the [`dist/`](./dist) folder. Embed it in your HTML file, and all filters are available in a global object called `xssFilters`. ```html + +...