xss-defender/dist/src/core/xss-defender.d.ts

A standalone library for XSS sanitization and detection.

import { SanitizationConfig } from "./config";
/**
 * Main class for XSS sanitization and defense.
 * Provides methods to sanitize strings, HTML content, objects, and URL parameters.
 */
export declare class XssDefender {
    private currentConfig;
    private readonly logger;
    /**
     * Initializes a new instance of the XssDefender.
     * @param initialConfig Optional initial configuration to override defaults.
     */
    constructor(initialConfig?: Partial<SanitizationConfig>);
    /**
     * Updates the current sanitization configuration.
     * @param config Partial configuration object to merge with the current settings.
     */
    setConfig(config: Partial<SanitizationConfig>): void;
    /**
     * Retrieves the current sanitization configuration.
     * @returns A read-only copy of the current configuration.
     */
    getConfig(): Readonly<SanitizationConfig>;
    /**
     * Performs basic sanitization of a string value based on the provided configuration.
     * This includes stripping dangerous patterns, and handling allowed/disallowed tags and attributes.
     * @param value The string to sanitize.
     * @param config The sanitization configuration to use.
     * @returns The sanitized string.
     */
    private _basicSanitization;
    /**
     * Sanitizes a string, removing potential XSS threats.
     * @param value The string to sanitize. Can be null or undefined, in which case an empty string is returned.
     * @returns The sanitized string.
     */
    sanitizeString(value: string | null | undefined): string;
    /**
     * Sanitizes an HTML string and sets it as the innerHTML of a given HTMLElement.
     * @param element The HTMLElement whose innerHTML is to be set.
     * @param unsafeHtml The potentially unsafe HTML string to sanitize and apply.
     */
    sanitizeHtmlForElement(element: HTMLElement, unsafeHtml: string): void;
    /**
     * Recursively sanitizes all string values within an object or an array.
     * @param obj The object or array to sanitize.
     * @returns The sanitized object or array.
     */
    sanitizeObject<T extends Record<string, any> | Array<any>>(obj: T): T;
    /**
     * Checks URL parameters for potential XSS risks and returns sanitized versions.
     * @param params A record of URL parameters.
     * @returns An object indicating if all parameters are safe and a list of any issues found.
     */
    checkUrlParams(params: Record<string, string | string[] | undefined>): {
        isSafe: boolean;
        issues: Array<{
            key: string;
            value: string;
            originalValue: string;
        }>;
    };
    /**
     * Checks if a given string contains known XSS risk patterns.
     * This method tests the string against `DANGEROUS_PATTERNS`.
     * @param value The string to check. Can be null or undefined.
     * @returns `true` if XSS risks are found, `false` otherwise.
     */
    hasXssRisks(value: string | null | undefined): boolean;
    private decodeNumericEntities;
    /**
     * Logs a detection event when sanitization modifies the input string.
     * @param originalValue The original, unsafe string.
     * @param sanitizedValue The sanitized string.
     */
    private _logDetection;
}