From 263d4093260707c6249eecb52ad52a0205e61351 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Sat, 4 Oct 2014 17:15:22 -0400 Subject: Basic xss prevention --- modules/base/tool.go | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'modules/base/tool.go') diff --git a/modules/base/tool.go b/modules/base/tool.go index b4083d09..38fd1e21 100644 --- a/modules/base/tool.go +++ b/modules/base/tool.go @@ -14,6 +14,7 @@ import ( "hash" "html/template" "math" + "regexp" "strings" "time" @@ -446,3 +447,29 @@ func DateFormat(t time.Time, format string) string { format = replacer.Replace(format) return t.Format(format) } + +type xssFilter struct { + reg *regexp.Regexp + repl []byte +} + +var ( + whiteSpace = []byte(" ") + xssFilters = []xssFilter{ + {regexp.MustCompile(`\ [ONon]\w*=["]*`), whiteSpace}, + {regexp.MustCompile(`<[SCRIPTscript]{6}`), whiteSpace}, + {regexp.MustCompile(`=[` + "`" + `'"]*[JAVASCRIPTjavascript \t\0 ]*:`), whiteSpace}, + } +) + +// XSS goes through all the XSS filters to make user input content as safe as possible. +func XSS(in []byte) []byte { + for _, filter := range xssFilters { + in = filter.reg.ReplaceAll(in, filter.repl) + } + return in +} + +func XSSString(in string) string { + return string(XSS([]byte(in))) +} -- cgit v1.2.3