Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
return async(ctx, next) => {
let query = ctx.query;
let bodyData = ctx.request.body;
let one = options.WHITELISTS.find((item) => item.pathReg.test(ctx.path));
// 黑科技
if (one && one.options && one.options.close) {
await next();
return;
}
let wrapOptions = one ? one.options : {};
const whiteList = xss.getDefaultWhiteList();
if (wrapOptions.enableStyle) {
for (let key of Object.keys(whiteList)) {
whiteList[key].push('style');
}
}
let customXss = new xss.FilterXSS({
whiteList
});
if (query) {
for (let key of Object.keys(query)) {
query[key] = customXss.process(query[key]);
}
}
var _ref = _asyncToGenerator(function* (ctx, next) {
let query = ctx.query;
let bodyData = ctx.request.body;
let one = options.WHITELISTS.find(function (item) {
return item.pathReg.test(ctx.path);
});
// 黑科技
if (one && one.options && one.options.close) {
yield next();
return;
}
let wrapOptions = one ? one.options : {};
const whiteList = xss.getDefaultWhiteList();
if (wrapOptions.enableStyle) {
for (let key of Object.keys(whiteList)) {
whiteList[key].push('style');
}
}
let customXss = new xss.FilterXSS({
whiteList
});
if (query) {
for (let key of Object.keys(query)) {
query[key] = customXss.process(query[key]);
}
}
html = `<br>${html}`;
}
return html;
});
return outputKatexHTML;
}
};
// 防止 xss 幫我們跳脫字元
function escapeHtml(html) {
return html;
}
const whiteList = xss.getDefaultWhiteList();
whiteList.span.push('class');
whiteList.span.push('style');
const xssFilter = {
type: 'output',
filter: function(text) {
return xss(text, { escapeHtml, whiteList, css: {
whiteList: {
'aria-hidden': true,
'vertical-align': true,
'top': true,
'position': true,
'height': true
}
} });
}
} catch (err) {}
}
try {
const prepared = hljs.highlightAuto(code);
return `<pre><code class="${prepared.language}">${
prepared.value
}</code></pre>`;
} catch (err) {}
return `<pre><code>${code}</code></pre>`;
};
return xss(marked(source, { renderer, mangle: false }), {
whiteList: {
...xss.getDefaultWhiteList(),
code: ['class'],
span: ['class'],
h1: ['id'],
h2: ['id'],
h3: ['id'],
h4: ['id'],
h5: ['id'],
h6: ['id'],
},
});
};