-
Notifications
You must be signed in to change notification settings - Fork 629
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: whitelist match failure due to case ignoring #256
Conversation
function keysToLowerCase(obj) { | ||
var ret = {}; | ||
for (var i in obj) { | ||
if (Array.isArray(obj[i])) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
考虑到整体代码风格的统一,这里不要用箭头函数。可改为:
ret[i.toLowerCase()] = obj[i].map(function (item) {
return item.toLowerCase();
});
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it!
test/test_xss.js
Outdated
@@ -15,8 +15,8 @@ function xss(html, options) { | |||
return ret; | |||
} | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
test_xss.js
这个文件也是类似的问题,跟本次要修复的问题无关的地方不要做修改(比如这里将 function()
改为 function ()
),其次不要用箭头函数
test/test_xss.js
Outdated
@@ -367,17 +367,17 @@ describe("test XSS", function() { | |||
assert.equal( | |||
xss( | |||
"<!--[if gte IE 4]><SCRI" + | |||
"PT>alert('XSS');</SCRI" + | |||
"PT><![endif]--> END", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这里增加了不相干的空格
close #173