anti
Version:
Anti is an XSS protection module.
403 lines (364 loc) • 21.8 kB
JavaScript
/*
The MIT License (MIT)
Copyright (c) 2015 Schahriar SaffarShargh
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
*/
/*
- Anti XSS Protection Module - --------------------
Author: Schahriar SaffarShargh <info@schahriar.com>
- ---------------------------- --------------------
Disclaimer:
This module utilizes a doze of insanity and a drop of blood from the Black Witch of the North to bring joy to your divs and html elements without the hassle of unwanted magic spells and bacteria incorporated with your non-sanitary method of sanitization. Thus it is highly experimental to the extent that even this sentence is currently being tested in our non-existent laboratory which I will assure you is experimental itself. Use it at your own risk.
- -------------------------- - --------------------
*/
;
(function () {
// Define a unique variable for DOMParser & XMLSerializer to prevent collisions
var ANTI_DOM_PARSER, ANTI_DOM_SERIALIZER;
// Determines which Parser (NodeJS:xmldom->DOMParser, Browsers:DOMParser) to attach to our unique variable
if (typeof DOMParser === "undefined") ANTI_DOM_PARSER = require('xmldom').DOMParser;
else ANTI_DOM_PARSER = DOMParser;
// Determines which Serializer (NodeJS:xmldom->XMLSerializer, Browsers:XMLSerializer) to attach to our unique variable
if (typeof XMLSerializer === "undefined") ANTI_DOM_SERIALIZER = require('xmldom').XMLSerializer;
else ANTI_DOM_SERIALIZER = XMLSerializer || Function;
// Weirdly wrap Anti around Module definition
var Module = (function () {
var Anti = function ANTI_LOCAL(options) {
this.Options = options || {};
// Default options
if(!this.Options.serialize) this.Options.serialize = true;
if(!this.Options.wrapper) this.Options.wrapper = "<div class='anti'></div>";
// XMLDOM Throws too many errors
this.Parser = new ANTI_DOM_PARSER({
errorHandler: {
warning: new Function,
error: new Function,
fatalError: new Function
}
});
/* Should throw if method serializeToString does not exist */
this.Serializer = new ANTI_DOM_SERIALIZER();
/// - DOM SAFELIST - ///
/* Add support for SVG */
/* Kills data attributes */
/* v0.2: Allow for individual attribute filtering per block && value per property */
this.ACCEPTABLE_BLOCK_ELEMENTS = ["#text", "a", "abbr", "acronym", "address", "article", "aside", "b", "bdi", "bdo", "big", "blockquote", "br", "caption", "center", "cite", "code", "colgroup", "dd", "del", "del", "dfn", "dir", "div", "dl", "dt", "em", "figcaption", "figure", "font", "footer", "h1", "h2", "h3", "h4", "h5", "h6", "header", "hgroup", "hr", "i", "img", "ins", "ins", "kbd", "label", "li", "map", "map", "mark", "menu", "nav", "ol", "p", "pre", "q", "rp", "rt", "ruby", "s", "samp", "section", "small", "span", "strike", "strong", "sub", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "time", "tr", "tt", "u", "ul", "var"];
this.ACCEPTABLE_SANITARY_ATTRIBUTES = ["abbr", "align", "alt", "axis", "bgcolor", "border", "cellpadding", "cellspacing", "class", "clear", "color", "cols", "colspan", "compact", "coords", "dir", "face", "headers", "height", "hreflang", "hspace", "ismap", "lang", "language", "nohref", "nowrap", "rel", "rev", "rows", "rowspan", "rules", "scope", "scrolling", "shape", "size", "span", "start", "summary", "tabindex", "target", "title", "type", "valign", "value", "vspace", "width"];
this.ACCEPTABLE_UNSANITARY_ATTRIBUTES = ["background", "cite", "href", "longdesc", "src", "usemap", "style", "xlink:href"];
/*<EXPERIMENTAL>*/
/// - ------------ - ///
/// - CSS SAFELIST - ///
// This list is derived from document.createElement('div').style
this.ACCEPTABLE_CSS_PROPERTIES = ["align-content", "align-items", "align-self", "alignment-baseline", "all", "animation", "animation-delay", "animation-direction", "animation-duration", "animation-fill-mode", "animation-iteration-count", "animation-name", "animation-play-state", "animation-timing-function", "backface-visibility", "background", "background-attachment", "background-blend-mode", "background-clip", "background-color", "background-image", "background-origin", "background-position", "background-position-x", "background-position-y", "background-repeat", "background-repeat-x", "background-repeat-y", "background-size", "baseline-shift", "border", "border-bottom", "border-bottom-color", "border-bottom-left-radius", "border-bottom-right-radius", "border-bottom-style", "border-bottom-width", "border-collapse", "border-color", "border-image", "border-image-outset", "border-image-repeat", "border-image-slice", "border-image-source", "border-image-width", "border-left", "border-left-color", "border-left-style", "border-left-width", "border-radius", "border-right", "border-right-color", "border-right-style", "border-right-width", "border-spacing", "border-style", "border-top", "border-top-color", "border-top-left-radius", "border-top-right-radius", "border-top-style", "border-top-width", "border-width", "bottom", "box-shadow", "box-sizing", "buffered-rendering", "caption-side", "clear", "clip", "clip-path", "clip-rule", "color", "color-interpolation", "color-interpolation-filters", "color-rendering", "content", "counter-increment", "counter-reset", "css-text", "cursor", "cx", "cy", "direction", "display", "dominant-baseline", "empty-cells", "enable-background", "fill", "fill-opacity", "fill-rule", "filter", "flex", "flex-basis", "flex-direction", "flex-flow", "flex-grow", "flex-shrink", "flex-wrap", "float", "flood-color", "flood-opacity", "font", "font-family", "font-kerning", "font-size", "font-stretch", "font-style", "font-variant", "font-variant-ligatures", "font-weight", "glyph-orientation-horizontal", "glyph-orientation-vertical", "height", "image-rendering", "isolation", "justify-content", "left", "length", "letter-spacing", "lighting-color", "line-height", "list-style", "list-style-image", "list-style-position", "list-style-type", "margin", "margin-bottom", "margin-left", "margin-right", "margin-top", "marker", "marker-end", "marker-mid", "marker-start", "mask", "mask-type", "max-height", "max-width", "max-zoom", "min-height", "min-width", "min-zoom", "mix-blend-mode", "object-fit", "object-position", "opacity", "order", "orientation", "orphans", "outline", "outline-color", "outline-offset", "outline-style", "outline-width", "overflow", "overflow-wrap", "overflow-x", "overflow-y", "padding", "padding-bottom", "padding-left", "padding-right", "padding-top", "page", "page-break-after", "page-break-before", "page-break-inside", "paint-order", "parent-rule", "null", "perspective", "perspective-origin", "pointer-events", "position", "quotes", "r", "resize", "right", "rx", "ry", "shape-image-threshold", "shape-margin", "shape-outside", "shape-rendering", "size", "speak", "src", "stop-color", "stop-opacity", "stroke", "stroke-dasharray", "stroke-dashoffset", "stroke-linecap", "stroke-linejoin", "stroke-miterlimit", "stroke-opacity", "stroke-width", "tab-size", "table-layout", "text-align", "text-anchor", "text-decoration", "text-indent", "text-overflow", "text-rendering", "text-shadow", "text-transform", "top", "touch-action", "transform", "transform-origin", "transform-style", "transition", "transition-delay", "transition-duration", "transition-property", "transition-timing-function", "unicode-bidi", "unicode-range", "user-zoom", "vector-effect", "vertical-align", "visibility", "white-space", "widows", "width", "will-change", "word-break", "word-spacing", "word-wrap", "writing-mode", "x", "y", "z-index", "zoom"];
/// - ------------ - ///
/*</EXPERIMENTAL>*/
};
Anti.prototype.parse = function ANTI_PARSER(HTML_STRING, callback) {
var ReturnAttributes = [];
// Get document and is root (ParsedROOT could be null)
var ParsedROOT = this._parseToImmediateDOM(HTML_STRING.toString());
/* HTML xmlns tag is retained on the wrapper */
// Wrapper element
var WRAPPER = this.Parser.parseFromString(this.Options.wrapper, "text/html").documentElement;
// Browser Fix (Browsers wrap the element in an HTML parent)
if (WRAPPER.nodeName.toLowerCase() === 'html') WRAPPER = (WRAPPER.childNodes[1])?WRAPPER.childNodes[1].childNodes[0]:WRAPPER;
if (ParsedROOT !== null) {
// Copies all childen into variable DOM
// Since the object above is not a simple JS Array (Should have a DOM-like structure on Browsers)
// I took the liberty to copy only what we need into a clean Array
this._cleanDOM(ParsedROOT, this._(ParsedROOT).children());
// Clean Root
var BODY_CHILDREN = this._(ParsedROOT).children();
this._(WRAPPER).children(BODY_CHILDREN);
}
return (this.Options.serialize) ? this.Serializer.serializeToString(WRAPPER) : WRAPPER;
}
Anti.prototype._parseToImmediateDOM = function ANTI_TO_IMMEDIATE(HTML_STRING) {
var _ROOT_, _DOCUMENT_;
// Catch any errors
try {
_DOCUMENT_ = this.Parser.parseFromString(HTML_STRING, "text/html");
}catch(e) {
if(e) return null;
}
/* Test if this works in every case & if an attacker could confuse it */
// Decide root from given document
if (this._(_DOCUMENT_.documentElement).tag === 'html') {
/// ROOT TAG -> HTML
// Find Body -> This works better on Browsers as they tend to
// wrap the DOMParser output in a #document object
this._(_DOCUMENT_.documentElement).children().forEach(function (node) {
if (node.tag === 'body') _ROOT_ = node.node;
})
} else if (this._(_DOCUMENT_.documentElement).tag === 'body') {
/// ROOT TAG -> BODY
_ROOT_ = _DOCUMENT_.documentElement;
} else {
/// ROOT TAG -> ROOT
_ROOT_ = _DOCUMENT_;
}
return _ROOT_;
};
Anti.prototype._cleanDOM = function ANTI_TO_CLEAN(ROOT, DIRTYDOM) {
var _this = this;
/* Improve performance and reduce resources */
// Cache solution
var EL_ATTRIBUTES_CACHE = [];
var CLEANDOM = [];
// Heavily recursive
DIRTYDOM.forEach(function (node, index) {
// Check if element is acceptable || #text
if ((_this._lookup(_this.ACCEPTABLE_BLOCK_ELEMENTS, node.tag)) || (node.tag === "#text")) {
// CLEAN BLOCK : *Attributes might still be dirty
EL_ATTRIBUTES_CACHE = node.attr();
EL_ATTRIBUTES_CACHE.forEach(function (attr, index) {
// REMOVE UNSANITARY ATTRIBUTES
if (_this._lookup(_this.ACCEPTABLE_SANITARY_ATTRIBUTES, attr.name)) {
// DO NOTHING FOR NOW - ATTR is acceptable
} else if (_this._lookup(_this.ACCEPTABLE_UNSANITARY_ATTRIBUTES, attr.name)) {
/* Add target:_blank to all a links */
/* Add option for cross site linking/replacement */
// Re-assign attribute with URL encoding
node.removeAttribute(attr.name);
if (attr.name === 'style') {
// If InlineCSS is enabled
if(_this.Options.experimentalInlineCSS && _this._parseInlineCSS) node.setAttribute(attr.name, _this._parseInlineCSS(attr.value));
} else {
node.setAttribute(attr.name, (_this._isValidURL(attr.value))?encodeURI(attr.value):encodeURIComponent(attr.value));
}
} else {
node.removeAttribute(attr.name);
}
})
// Recursively clean children
_this._cleanDOM(node, node.children());
// PUSH CLEAN BLOCK
CLEANDOM.push(node);
} // -> Else ignore the element (Wouldn't be included in CleanDOM)
})
_this._(ROOT).children(CLEANDOM);
}
Anti.prototype._lookup = function ANTI_PARAM_LOOKUP(ARRAY, NAME_STRING) {
if (!NAME_STRING || !ARRAY) return false;
// Returns True if STRING is a part of the Array or False if it isn't
return (ARRAY.indexOf(NAME_STRING.toLowerCase()) >= 0);
}
/*<EXPERIMENTAL>*/
Anti.prototype._parseInlineCSS = function ANTI_CSS_INLINE(CSS_STRING, OUTPUT) {
// PERFORMANCE COMPARISON OF CHAR SELECTION http://jsperf.com/charat-vs-regex-vs-prop/3 & LATER REVISIONS
// PROP (STRING[index]) WAS SELECTED DUE TO CONSISTENT PERFORMANCE
var CSSOM_KEY_VALUE_STORE = new Object;
// Buffers
var PROPERTY_BUFFER = "";
var VALUE_BUFFER = "";
// Scope Indicators
var PROPERTY_OPEN = true;
var VALUE_OPEN = false;
// Determines validity of CSS values/URLs
var VALUE_URL = "";
var IS_VALID = true;
// Characters that we ignore in the for loop
var IGNORED_CHARS = " ,\n,\t".split(',');
for (var i = 0; i < CSS_STRING.length; i++) {
// If Char is not part of the ACCEPTABLE_CHARS
if (this._lookup(IGNORED_CHARS, CSS_STRING[i].toLowerCase())) continue;
if (PROPERTY_OPEN) {
if (CSS_STRING[i] === ':') {
/// Switch to Value Mode
PROPERTY_OPEN = false;
VALUE_OPEN = true;
///
} else {
// Buffer property
PROPERTY_BUFFER += CSS_STRING[i];
}
} else {
if (CSS_STRING[i] === ';') { /* ALL CSS VALUES MUST END WITH A SEMI-COLON, Make a pull request if this is not valid it would be easy to do a EOL validation here */
/// Switch to Property Mode
PROPERTY_OPEN = true;
VALUE_OPEN = false;
///
// if property is part of the list
if (this._lookup(this.ACCEPTABLE_CSS_PROPERTIES, PROPERTY_BUFFER)) {
// Check if property contains a url value
if (VALUE_BUFFER.substring(0, 3) === 'url') {
// Determine format of the css value
if (VALUE_BUFFER[4] === "'") {
// FORMAT = url('http://example.com')
VALUE_URL = VALUE_BUFFER.substring(4,VALUE_BUFFER.length-2);
} else {
// FORMAT = url(http://example.com)
VALUE_URL = VALUE_BUFFER.substring(3,VALUE_BUFFER.length-1);
}
// Validate through *REGEX
IS_VALID = this._isValidURL(VALUE_URL);
VALUE_URL = "";
}
// If Property is Valid : Assign properties to the Store
if (IS_VALID) CSSOM_KEY_VALUE_STORE[PROPERTY_BUFFER.toLowerCase()] = VALUE_BUFFER;
else IS_VALID = true;
}
// Reset buffers
PROPERTY_BUFFER = VALUE_BUFFER = "";
} else {
// Buffer value
VALUE_BUFFER += CSS_STRING[i];
}
}
}
// Covert back to inline string
var OUTPUT_STRING = "";
for (var key in CSSOM_KEY_VALUE_STORE) {
// Format = css-property: value;
OUTPUT_STRING += key + ':' + CSSOM_KEY_VALUE_STORE[key] + '; ';
}
// An Output argument to this function
// determines whether CSSOM or String returns
return (OUTPUT === "OBJECT") ? CSSOM_KEY_VALUE_STORE : OUTPUT_STRING;
}
/*</EXPERIMENTAL>*/
Anti.prototype._isValidURL = function ANTI_VALID_URL(URL_STRING) {
// Credits to Diego Perini https://gist.github.com/dperini/729294
// MIT License found at CREDITS file
var URL_TEST = new RegExp(
"^" +
// protocol identifier
"(?:(?:https?|ftp)://)" +
// user:pass authentication
"(?:\\S+(?::\\S*)?@)?" +
"(?:" +
// IP address exclusion
// private & local networks
"(?!(?:10|127)(?:\\.\\d{1,3}){3})" +
"(?!(?:169\\.254|192\\.168)(?:\\.\\d{1,3}){2})" +
"(?!172\\.(?:1[6-9]|2\\d|3[0-1])(?:\\.\\d{1,3}){2})" +
// IP address dotted notation octets
// excludes loopback network 0.0.0.0
// excludes reserved space >= 224.0.0.0
// excludes network & broacast addresses
// (first & last IP address of each class)
"(?:[1-9]\\d?|1\\d\\d|2[01]\\d|22[0-3])" +
"(?:\\.(?:1?\\d{1,2}|2[0-4]\\d|25[0-5])){2}" +
"(?:\\.(?:[1-9]\\d?|1\\d\\d|2[0-4]\\d|25[0-4]))" +
"|" +
// host name
"(?:(?:[a-z\\u00a1-\\uffff0-9]-*)*[a-z\\u00a1-\\uffff0-9]+)" +
// domain name
"(?:\\.(?:[a-z\\u00a1-\\uffff0-9]-*)*[a-z\\u00a1-\\uffff0-9]+)*" +
// TLD identifier
"(?:\\.(?:[a-z\\u00a1-\\uffff]{2,}))" +
// TLD may end with dot
"\\.?" +
")" +
// port number
"(?::\\d{2,5})?" +
// resource path
"(?:[/?#]\\S*)?" +
"$", "i"
);
return URL_TEST.test(URL_STRING);
}
// Helper functions (jQuery like)
Anti.prototype._ = function ANTI_NODE_EXT(node) {
if (node.ANTI_WRAPPED) node = node.node;
var _this = this;
return {
tag: (node.nodeName)?node.nodeName.toLowerCase():node.tagName,
remove: function ANTI_DOM_REMOVE() {
// Removes Current Node
node.parentNode.removeChild(node)
},
attr: function ANTI_DOM_ATTR() {
var NODE_ATTRIBUTES = [];
// Allow for #text elements
if (!node.attributes) return NODE_ATTRIBUTES;
for (var i = 0; i < node.attributes.length; i++) {
NODE_ATTRIBUTES[i] = {
name: node.attributes[i].name,
value: node.attributes[i].value
}
}
// Returns/Sets Node Attributes
return NODE_ATTRIBUTES;
},
removeAttribute: function ANTI_ATTR_REMOVE(ATTR) {
node.removeAttribute(ATTR);
},
setAttribute: function ANTI_ATTR_SET(ATTR, VALUE) {
node.setAttribute(ATTR, VALUE);
},
children: function ANTI_DOM_CHILDREN(children, native) {
// Returns/Sets Node Children
if (!children) {
var NODE_CHILDREN = [];
// Allow for #text elements
if (!node.childNodes) return NODE_CHILDREN;
// Wrap every child around _
for (var i = 0; i < node.childNodes.length; i++) {
if (!native) NODE_CHILDREN[i] = _this._(node.childNodes[i]);
else NODE_CHILDREN[i] = node.childNodes[i];
}
return NODE_CHILDREN;
} else {
var NODE_CHILDREN = [];
/* Nodes removed without cloning will append removed/null elements
This requires Cloning of all children
* If you find a better method for this please create a pull request
I would be glad to avoid 3 loops in a recursive function
*/
for (var i = 0; i < children.length; i++) {
NODE_CHILDREN[i] = (children[i].node)?children[i].node.cloneNode(true):children[i].cloneNode(true);
}
// Remove all current children
while (node.lastChild) {
node.removeChild(node.lastChild);
}
// Append allowed/cloned children
for (var i = 0; i < NODE_CHILDREN.length; i++) {
node.appendChild(NODE_CHILDREN[i]);
}
return node.childNodes;
}
},
parent: function ANTI_DOM_PARENT() {
// Returns parent node
return _this._(node.parentNode);
},
isValid: function ANTI_DOM_ISVALID() {
return (node.namespaceURI) || (node.documentElement) || (node.childNodes.length > 0);
},
node: node,
ANTI_WRAPPED: true
}
}
return Anti;
})();
// Support for NODEJS, AMD, BROWSERS Thanks to http://www.matteoagosti.com/blog/2013/02/24/writing-javascript-modules-for-both-browser-and-node/
if (typeof module !== 'undefined' && typeof module.exports !== 'undefined') {
module.exports = Module;
}
else {
if (typeof define === 'function' && define.amd) {
define([], function () {
return Module;
});
}
else {
window.Anti = Module;
}
}
})();