astuteweb-utils/src/xss/index.js

机敏web开发常用工具函数

/**
 * Sanitizes html special characters from input strings. For mitigating risk of XSS attacks.
 *
 * @param {*} rawText The raw input from the user that should be escaped.
 * @return {*} 
 */
function escapeHtml(rawText) {
    return rawText
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;')
        .replace(/'/g, '&apos;')
}


/**
 * Escapes html tags and special symbols from all provided params which were returned from parseArgs().params.
 *  This method performs an in-place operation on the params object.
 * @export
 * @param {*} params params Parameters as provided from `parseArgs().params`. May be either an array of strings or a string->any map.
 * @return {*}  The manipulated `params` object.
 */
export function escapeParams(params) {
    if(params != null) {
        Object.keys(params).forEach(key => {
            if(typeof(params[key]) === 'string') {
                params[key] = escapeHtml(params[key]);
            }
        })
    }
    return params;
}