diff --git a/lib/xss.js b/lib/xss.js index 8210182a..6b735536 100644 --- a/lib/xss.js +++ b/lib/xss.js @@ -60,6 +60,20 @@ function shallowCopyObject(obj) { return ret; } +function keysToLowerCase(obj) { + var ret = {}; + for (var i in obj) { + if (Array.isArray(obj[i])) { + ret[i.toLowerCase()] = obj[i].map(function (item) { + return item.toLowerCase(); + }); + } else { + ret[i.toLowerCase()] = obj[i]; + } + } + return ret; +} + /** * FilterXSS class * @@ -80,8 +94,12 @@ function FilterXSS(options) { } options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll; } + if (options.whiteList || options.allowList) { + options.whiteList = keysToLowerCase(options.whiteList || options.allowList); + } else { + options.whiteList = DEFAULT.whiteList; + } - options.whiteList = options.whiteList || options.allowList || DEFAULT.whiteList; options.onTag = options.onTag || DEFAULT.onTag; options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr; options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag; diff --git a/test/test_xss.js b/test/test_xss.js index deb8f929..6ea61e08 100644 --- a/test/test_xss.js +++ b/test/test_xss.js @@ -167,7 +167,7 @@ describe("test XSS", function() { ); }); - it("#allowList", ()=>{ + it("#allowList", function() { // 过滤所有标签 assert.equal( xss('bb', { allowList: {} }), @@ -432,4 +432,16 @@ describe("test XSS", function() { // console.log(options); assert.deepEqual(options, {}); }); + + it("camel case tag names", function() { + assert.equal(xss('', { + whiteList: { + animateTransform: ["attributeType", "repeatCount"] + } + }), + ''); + }); });