Options
All
  • Public
  • Public/Protected
  • All
Menu

Class XssHtmlValidator

Validator which sanitizes HTML content to eliminate XSS (cross-site scripting) security risks. This validator has some special functionality surrounding the handling of URIs as they are sanitized:

  • When the HTML is sanitized, we place all URIs into an array, replacing them in the HTML with replacement tokens.
  • The URIs are then run through the Content Policy instance, which asynchronously determines the fate of each URI. At this point, the user might be prompted about allowing dangerous URIs. The Content Policy overwrites the URIs in-place.
  • The manipulated URIs are then injected back into the sanitized HTML, and in the correct locations (token replacement).
  • The final sanitized HTML string is returned in the ValidationResult.

Hierarchy

  • XssHtmlValidator

Implements

Index

Constructors

Properties

Methods

Constructors

constructor

Properties

Protected _contentPolicy

_contentPolicy: ContentPolicy

Overriding content policy for this validator. Takes precedence over the content policy specified as context to validate().

Protected _tokenLeft

_tokenLeft: string

Protected _tokenLeftEscaped

_tokenLeftEscaped: string

Protected _tokenRight

_tokenRight: string

Protected _tokenRightEscaped

_tokenRightEscaped: string

Methods

Protected _applyUris

Protected _escape

Protected _runUrisThroughContentPolicy

Protected _sanitize

Protected _tokenize

  • _tokenize(index: number): string

  • Turn an index number into a replacement token.

    Parameters

    • index: number

    Returns string

Protected _unescape

validate

  • Sanitize a string of HTML to eliminate XSS risks.

    • Use FilterUtils to sanitize the HTML. Compile all URIs into an array, and replace them in the HTML with replacement tokens.
    • Pass URIs through the Content Policy (which rewrites them), and insert them back into the HTML (token replacement).
    • Return the sanitized HTML.

    Parameters

    Returns Promise<ValidationResult<string>>

    String of sanitized HTML.