36 lines
1.1 KiB
JavaScript
36 lines
1.1 KiB
JavaScript
const DANGEROUS_TAG_NAMES = [
|
|
'script',
|
|
'iframe',
|
|
'object',
|
|
'embed',
|
|
'form',
|
|
'input',
|
|
'button',
|
|
'textarea',
|
|
'select',
|
|
'meta',
|
|
'link',
|
|
'base'
|
|
]
|
|
|
|
const dangerousTagPattern = new RegExp(`<\\s*(${DANGEROUS_TAG_NAMES.join('|')})\\b[\\s\\S]*?<\\s*\\/\\s*\\1\\s*>`, 'gi')
|
|
const dangerousSingleTagPattern = new RegExp(`<\\s*(${DANGEROUS_TAG_NAMES.join('|')})\\b[^>]*\\/?>`, 'gi')
|
|
|
|
/**
|
|
* 본문 HTML 블록에서 실행성 코드와 위험 속성을 제거한다.
|
|
* @param {string} value - 원본 HTML
|
|
* @returns {string} 정리된 HTML
|
|
*/
|
|
export const sanitizeHtmlBlock = (value) => String(value || '')
|
|
.replace(dangerousTagPattern, '')
|
|
.replace(dangerousSingleTagPattern, '')
|
|
.replace(/\s+on[a-z]+\s*=\s*"[^"]*"/gi, '')
|
|
.replace(/\s+on[a-z]+\s*=\s*'[^']*'/gi, '')
|
|
.replace(/\s+on[a-z]+\s*=\s*[^\s>]+/gi, '')
|
|
.replace(/\s+(href|src)\s*=\s*"javascript:[^"]*"/gi, '')
|
|
.replace(/\s+(href|src)\s*=\s*'javascript:[^']*'/gi, '')
|
|
.replace(/\s+(href|src)\s*=\s*javascript:[^\s>]+/gi, '')
|
|
.replace(/\s+style\s*=\s*"[^"]*expression\s*\([^"]*"/gi, '')
|
|
.replace(/\s+style\s*=\s*'[^']*expression\s*\([^']*'/gi, '')
|
|
.trim()
|