XSS組件

xingqiba 發(fā)布于2019-08-20 15:21 / 504人閱讀

摘要：公司用到的防止攻擊的組件代碼空過濾過度方案過濾字符串中的過濾節(jié)點(diǎn)屬性中的過濾

公司用到的防止xss攻擊的組件代碼



    function $xss(str,type){
        
        //空過濾
        if(!str){
            return str===0 ? "0" : "";
        }

        switch(type){
            case "none": //過度方案
                return str+"";
                break;
            case "html": //過濾html字符串中的XSS
                return str.replace(/[&""<>/-x00-x09x0b-x0cx1fx80-xff]/g, function(r){
                    return "&#" + r.charCodeAt(0) + ";"
                }).replace(/ /g, " ").replace(/
/g, "
").replace(/
/g,"
").replace(/
/g,"
");
                break;
            case "htmlEp": //過濾DOM節(jié)點(diǎn)屬性中的XSS
                return str.replace(/[&""<>/-x00-x1fx80-xff]/g, function(r){
                    return "&#" + r.charCodeAt(0) + ";"
                });
                break;
            case "url": //過濾url
                return escape(str).replace(/+/g, "%2B");
                break;
            case "miniUrl":
                return str.replace(/%/g, "%25");
                break;
            case "script":
                return str.replace(/[""]/g, function(r){
                    return "" + r;
                }).replace(/%/g, "x25").replace(/
/g, "
").replace(/
/g, "
").replace(/x01/g, "x01");
                break;
            case "reg":
                return str.replace(/[^$*+?{}.()[]]/g, function(a){
                    return "" + a;
                });
                break;
            default:
                return escape(str).replace(/[&""<>/-x00-x09x0b-x0cx1fx80-xff]/g, function(r){
                    return "&#" + r.charCodeAt(0) + ";"
                }).replace(/ /g, " ").replace(/
/g, "
").replace(/
/g,"
").replace(/
/g,"
");
                break;
        }
    }