search

leizongmin / js-xss

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
http://jsxss.com
Other
5.2k stars 629 forks source link

if a blank in style or class, the filter html has error #158

Open stepli1010 opened 5 years ago

stepli1010 commented 5 years ago

input is :"<div style=\"color: red;\" class=\"class1 class2\">323</div> " output: "<div style=\"color: class=\"class1>323</div>"

reason is the blank in attr。 i read the code, find the problem maybe the function findBeforeEqual in parser.js.