Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How can I remove [removed] text from stripIgnoreTagBody: ['script'] option? #244

Open
amjadaliup opened this issue Nov 10, 2021 · 2 comments

Comments

@amjadaliup
Copy link

I given stripIgnoreTagBody option as ['script'] and given input is like,


some text..
<script>alert(1);

And got out put as:-


some text..
[removed]alert(1);

I only need output like:-


some text..
alert(1);

how can I remove [removed] text from output.
Not:- if I give [removed] in input that will be in output.

Thanks in advance

@lumburr
Copy link
Contributor

lumburr commented Mar 11, 2022

@amjadaliup
I think what you need to use is the stripIgnoreTag attribute, which you can set like this:

  const source = `some text..<script>alert(1);`;
  const html = filterXSS(source, {
    whiteList: {}, // just make sure that the whiteList does not contain script
    stripIgnoreTag: true, // filter out all HTML not in the whitelist
  });

Or a more violent way

const html = filterXSS(source, {
    onTag: function onTag(tag, html, options) {
      if (tag === 'script') {
        return ''
      }
    }
  })

@amjadaliup
Copy link
Author

@lumburr
Thank you for your answer. But I need to remove body content of the script tag also. That is not possible with these 2 ways.
I'm using stripIgnoreTagBody: ['script'] for that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants