Skip to content

fix: 修复 XSS 库中的原型污染漏洞 #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leizongmin merged 3 commits into from
May 6, 2026
+178 −45
Merged

fix: 修复 XSS 库中的原型污染漏洞 #298

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
09f5ceb
feat: 修复 XSS 库中的原型污染漏洞
leizongmin May 5, 2026
f8ffd38
feat: 修复 XSS 库中的原型污染漏洞
leizongmin May 5, 2026
d209d1e
feat: 修复 XSS 库中的原型污染漏洞
leizongmin May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 31 additions & 22 deletions dist/xss.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -490,10 +490,14 @@ exports.FilterXSS = FilterXSS;

(function () {
for (var i in DEFAULT) {
exports[i] = DEFAULT[i];
if (Object.prototype.hasOwnProperty.call(DEFAULT, i)) {
exports[i] = DEFAULT[i];
}
}
for (var j in parser) {
exports[j] = parser[j];
if (Object.prototype.hasOwnProperty.call(parser, j)) {
exports[j] = parser[j];
}
}
})();

Expand Down Expand Up @@ -867,20 +871,24 @@ function getAttrs(html) {
function shallowCopyObject(obj) {
var ret = {};
for (var i in obj) {
ret[i] = obj[i];
if (Object.prototype.hasOwnProperty.call(obj, i)) {
ret[i] = obj[i];
}
}
return ret;
}

function keysToLowerCase(obj) {
var ret = {};
for (var i in obj) {
if (Array.isArray(obj[i])) {
ret[i.toLowerCase()] = obj[i].map(function (item) {
return item.toLowerCase();
});
} else {
ret[i.toLowerCase()] = obj[i];
if (Object.prototype.hasOwnProperty.call(obj, i)) {
if (Array.isArray(obj[i])) {
ret[i.toLowerCase()] = obj[i].map(function (item) {
return item.toLowerCase();
});
} else {
ret[i.toLowerCase()] = obj[i];
}
}
}
return ret;
Expand All @@ -898,34 +906,35 @@ function keysToLowerCase(obj) {
function FilterXSS(options) {
options = shallowCopyObject(options || {});

if (options.stripIgnoreTag) {
if (options.onIgnoreTag) {
if (Object.prototype.hasOwnProperty.call(options, 'stripIgnoreTag') && options.stripIgnoreTag) {
if (Object.prototype.hasOwnProperty.call(options, 'onIgnoreTag') && options.onIgnoreTag) {
console.error(
'Notes: cannot use these two options "stripIgnoreTag" and "onIgnoreTag" at the same time'
);
}
options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
}
if (options.whiteList || options.allowList) {
options.whiteList = keysToLowerCase(options.whiteList || options.allowList);
if (Object.prototype.hasOwnProperty.call(options, 'whiteList') || Object.prototype.hasOwnProperty.call(options, 'allowList')) {
const wl = Object.prototype.hasOwnProperty.call(options, 'whiteList') ? options.whiteList : options.allowList;
options.whiteList = keysToLowerCase(wl);
} else {
options.whiteList = DEFAULT.whiteList;
}

this.attributeWrapSign = options.singleQuotedAttributeValue === true ? "'" : DEFAULT.attributeWrapSign;
this.attributeWrapSign = Object.prototype.hasOwnProperty.call(options, 'singleQuotedAttributeValue') && options.singleQuotedAttributeValue === true ? "'" : DEFAULT.attributeWrapSign;

options.onTag = options.onTag || DEFAULT.onTag;
options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;
options.onIgnoreTagAttr = options.onIgnoreTagAttr || DEFAULT.onIgnoreTagAttr;
options.safeAttrValue = options.safeAttrValue || DEFAULT.safeAttrValue;
options.escapeHtml = options.escapeHtml || DEFAULT.escapeHtml;
options.onTag = Object.prototype.hasOwnProperty.call(options, 'onTag') ? options.onTag : DEFAULT.onTag;
options.onTagAttr = Object.prototype.hasOwnProperty.call(options, 'onTagAttr') ? options.onTagAttr : DEFAULT.onTagAttr;
options.onIgnoreTag = Object.prototype.hasOwnProperty.call(options, 'onIgnoreTag') ? options.onIgnoreTag : DEFAULT.onIgnoreTag;
options.onIgnoreTagAttr = Object.prototype.hasOwnProperty.call(options, 'onIgnoreTagAttr') ? options.onIgnoreTagAttr : DEFAULT.onIgnoreTagAttr;
options.safeAttrValue = Object.prototype.hasOwnProperty.call(options, 'safeAttrValue') ? options.safeAttrValue : DEFAULT.safeAttrValue;
options.escapeHtml = Object.prototype.hasOwnProperty.call(options, 'escapeHtml') ? options.escapeHtml : DEFAULT.escapeHtml;
this.options = options;

if (options.css === false) {
if (Object.prototype.hasOwnProperty.call(options, 'css') && options.css === false) {
this.cssFilter = false;
} else {
options.css = options.css || {};
options.css = Object.prototype.hasOwnProperty.call(options, 'css') ? options.css : {};
this.cssFilter = new FilterCSS(options.css);
}
}
Expand Down
2 changes: 1 addition & 1 deletion dist/xss.min.js
View file
Open in desktop

Large diffs are not rendered by default.

8 changes: 6 additions & 2 deletions lib/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,14 @@ exports.FilterXSS = FilterXSS;

(function () {
for (var i in DEFAULT) {
exports[i] = DEFAULT[i];
if (Object.prototype.hasOwnProperty.call(DEFAULT, i)) {
exports[i] = DEFAULT[i];
}
}
for (var j in parser) {
exports[j] = parser[j];
if (Object.prototype.hasOwnProperty.call(parser, j)) {
exports[j] = parser[j];
}
}
})();

Expand Down
45 changes: 25 additions & 20 deletions lib/xss.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,20 +55,24 @@ function getAttrs(html) {
function shallowCopyObject(obj) {
var ret = {};
for (var i in obj) {
ret[i] = obj[i];
if (Object.prototype.hasOwnProperty.call(obj, i)) {
ret[i] = obj[i];
}
}
return ret;
}

function keysToLowerCase(obj) {
var ret = {};
for (var i in obj) {
if (Array.isArray(obj[i])) {
ret[i.toLowerCase()] = obj[i].map(function (item) {
return item.toLowerCase();
});
} else {
ret[i.toLowerCase()] = obj[i];
if (Object.prototype.hasOwnProperty.call(obj, i)) {
if (Array.isArray(obj[i])) {
ret[i.toLowerCase()] = obj[i].map(function (item) {
return item.toLowerCase();
});
} else {
ret[i.toLowerCase()] = obj[i];
}
}
}
return ret;
Expand All @@ -86,34 +90,35 @@ function keysToLowerCase(obj) {
function FilterXSS(options) {
options = shallowCopyObject(options || {});

if (options.stripIgnoreTag) {
if (options.onIgnoreTag) {
if (Object.prototype.hasOwnProperty.call(options, 'stripIgnoreTag') && options.stripIgnoreTag) {
if (Object.prototype.hasOwnProperty.call(options, 'onIgnoreTag') && options.onIgnoreTag) {
console.error(
'Notes: cannot use these two options "stripIgnoreTag" and "onIgnoreTag" at the same time'
);
}
options.onIgnoreTag = DEFAULT.onIgnoreTagStripAll;
}
if (options.whiteList || options.allowList) {
options.whiteList = keysToLowerCase(options.whiteList || options.allowList);
if (Object.prototype.hasOwnProperty.call(options, 'whiteList') || Object.prototype.hasOwnProperty.call(options, 'allowList')) {
const wl = Object.prototype.hasOwnProperty.call(options, 'whiteList') ? options.whiteList : options.allowList;
options.whiteList = keysToLowerCase(wl);
} else {
options.whiteList = DEFAULT.whiteList;
}

this.attributeWrapSign = options.singleQuotedAttributeValue === true ? "'" : DEFAULT.attributeWrapSign;
this.attributeWrapSign = Object.prototype.hasOwnProperty.call(options, 'singleQuotedAttributeValue') && options.singleQuotedAttributeValue === true ? "'" : DEFAULT.attributeWrapSign;

options.onTag = options.onTag || DEFAULT.onTag;
options.onTagAttr = options.onTagAttr || DEFAULT.onTagAttr;
options.onIgnoreTag = options.onIgnoreTag || DEFAULT.onIgnoreTag;
options.onIgnoreTagAttr = options.onIgnoreTagAttr || DEFAULT.onIgnoreTagAttr;
options.safeAttrValue = options.safeAttrValue || DEFAULT.safeAttrValue;
options.escapeHtml = options.escapeHtml || DEFAULT.escapeHtml;
options.onTag = Object.prototype.hasOwnProperty.call(options, 'onTag') ? options.onTag : DEFAULT.onTag;
options.onTagAttr = Object.prototype.hasOwnProperty.call(options, 'onTagAttr') ? options.onTagAttr : DEFAULT.onTagAttr;
options.onIgnoreTag = Object.prototype.hasOwnProperty.call(options, 'onIgnoreTag') ? options.onIgnoreTag : DEFAULT.onIgnoreTag;
options.onIgnoreTagAttr = Object.prototype.hasOwnProperty.call(options, 'onIgnoreTagAttr') ? options.onIgnoreTagAttr : DEFAULT.onIgnoreTagAttr;
options.safeAttrValue = Object.prototype.hasOwnProperty.call(options, 'safeAttrValue') ? options.safeAttrValue : DEFAULT.safeAttrValue;
options.escapeHtml = Object.prototype.hasOwnProperty.call(options, 'escapeHtml') ? options.escapeHtml : DEFAULT.escapeHtml;
this.options = options;

if (options.css === false) {
if (Object.prototype.hasOwnProperty.call(options, 'css') && options.css === false) {
this.cssFilter = false;
} else {
options.css = options.css || {};
options.css = Object.prototype.hasOwnProperty.call(options, 'css') ? options.css : {};
this.cssFilter = new FilterCSS(options.css);
}
}
Expand Down
115 changes: 115 additions & 0 deletions test/test_xss.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -467,4 +467,119 @@ describe("test XSS", function() {
}),
'<animatetransform attributetype="XML" repeatcount="indefinite" />');
});

describe("prototype pollution protection", function() {
it("should not use properties from Object.prototype when no options are given", function() {
// Store original prototype
const originalProto = Object.prototype;
const originalOnTag = originalProto.onTag;
const originalOnTagAttr = originalProto.onTagAttr;
const originalOnIgnoreTag = originalProto.onIgnoreTag;
const originalOnIgnoreTagAttr = originalProto.onIgnoreTagAttr;
const originalSafeAttrValue = originalProto.safeAttrValue;
const originalEscapeHtml = originalProto.escapeHtml;
const originalWhiteList = originalProto.whiteList;
const originalCss = originalProto.css;
const originalStripIgnoreTag = originalProto.stripIgnoreTag;
const originalSingleQuotedAttributeValue = originalProto.singleQuotedAttributeValue;

try {
// Pollute prototype
let onTagCalled = false;
let escapeHtmlCalled = false;
let safeAttrValueCalled = false;
const evilWhiteList = { script: ["src"] };
const evilCss = false;

Object.prototype.onTag = () => {
onTagCalled = true;
return '<img src=x onerror=alert(1)>';
};
Object.prototype.onTagAttr = () => {};
Object.prototype.onIgnoreTag = () => {};
Object.prototype.onIgnoreTagAttr = () => {};
Object.prototype.safeAttrValue = () => {
safeAttrValueCalled = true;
return "javascript:alert(1)";
};
Object.prototype.escapeHtml = () => {
escapeHtmlCalled = true;
return '<img src=x onerror=alert(1)>';
};
Object.prototype.whiteList = evilWhiteList;
Object.prototype.allowList = evilWhiteList;
Object.prototype.stripIgnoreTag = true;
Object.prototype.singleQuotedAttributeValue = true;
Object.prototype.css = evilCss;

// Test xss without options
const result = xss("<p>text</p>");
const result2 = xss('<script src="evil.js"></script>');
const result3 = xss('<a href="https://example.com">click</a>');

// Verify no pollution effects
assert.equal(onTagCalled, false, "onTag should not be called from prototype");
assert.equal(escapeHtmlCalled, false, "escapeHtml should not be called from prototype");
assert.equal(safeAttrValueCalled, false, "safeAttrValue should not be called from prototype");
assert.equal(result, "<p>text</p>");
assert.equal(result2, "&lt;script src=\"evil.js\"&gt;&lt;/script&gt;");
assert.equal(result3, '<a href="https://example.com">click</a>');
} finally {
// Restore prototype
delete Object.prototype.onTag;
delete Object.prototype.onTagAttr;
delete Object.prototype.onIgnoreTag;
delete Object.prototype.onIgnoreTagAttr;
delete Object.prototype.safeAttrValue;
delete Object.prototype.escapeHtml;
delete Object.prototype.whiteList;
delete Object.prototype.allowList;
delete Object.prototype.stripIgnoreTag;
delete Object.prototype.singleQuotedAttributeValue;
delete Object.prototype.css;
}
});

it("should not use properties from Object.prototype when options are given", function() {
// Store original prototype
const originalProto = Object.prototype;
const originalOnTag = originalProto.onTag;
const originalWhiteList = originalProto.whiteList;

try {
// Pollute prototype
let prototypeOnTagCalled = false;
let prototypeEscapeHtmlCalled = false;

Object.prototype.onTag = () => {
prototypeOnTagCalled = true;
return '<evil>';
};
Object.prototype.escapeHtml = () => {
prototypeEscapeHtmlCalled = true;
return '<evil>';
};

// Test xss with options
let customOnTagCalled = false;
const options = {
onTag: () => {
customOnTagCalled = true;
return null;
}
};
const result = xss("<p>text</p>", options);

// Verify
assert.equal(prototypeOnTagCalled, false, "Prototype onTag should not be called");
assert.equal(prototypeEscapeHtmlCalled, false, "Prototype escapeHtml should not be called");
assert.equal(customOnTagCalled, true, "Custom onTag should be called");
assert.equal(result, "<p>text</p>");
} finally {
// Restore prototype
delete Object.prototype.onTag;
delete Object.prototype.escapeHtml;
}
});
});
});
Loading