Question

i m 试图在将它输入数据库之前使html窒息性,即使用先质-htmlnpm包,但它没有工作

if (noteContent) {
  const resultContent = sanitize(noteContent);
  console.log(resultContent);
} else {
  setErrorMessages((prevState) => ["note content cannot be empty"]);
}

here when i m entering <img src=? onerror="alert( hello )" />
it returns:

<p><img src=? onerror="alert( hello )" /></p>

难道看不错什么?

Answer 1

根据上查阅的文件,你正在研究的职能应当称为sanitizeHtml(,而不是sanitize()。

However, if you read closely, per default it does allow quite some html tags and attributes listed here: https://github.com/apostrophecms/sanitize-html?tab=readme-ov-file#default-options

为了进一步限制,遵循文件。

// Allow only a super restricted set of tags and attributes
const clean = sanitizeHtml(dirty, {
  allowedTags: [  b ,  i ,  em ,  strong ,  a  ],
  allowedAttributes: {
     a : [  href  ]
  },
  allowedIframeHostnames: [ www.youtube.com ]
});

举例来说,如果是这样的话:

if (noteContent) {
  const resultContent = sanitizeHtml(noteContent, {
    allowedTags: [], 
    allowedAttributes: {}
  });
  console.log(resultContent);
} else {
  setErrorMessages((prevState) => ["note content cannot be empty"]);
}

另见,文件。

友情链接