Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

单纯一份JS,如何设置css 为false? #248

Open
AceChen1 opened this issue Nov 29, 2021 · 2 comments
Open

单纯一份JS,如何设置css 为false? #248

AceChen1 opened this issue Nov 29, 2021 · 2 comments

Comments

@AceChen1
Copy link

AceChen1 commented Nov 29, 2021

如果是es5/6 可以直接这样调用:
myxss = new xss.FilterXSS({
css: false,
});

但是如果只是单纯的js, 如何在filterXSS 里设置css 为false ?
var html = filterXSS('<script>alert("xss");</scr' + "ipt>");

@leizongmin

@Huanxin1997
Copy link

image
我们尝试只保留 this.cssFilter = false; , 行间样式仍被去除。
有没有相关配置能够保留行间样式呢?

@leizongmin
Copy link
Owner

@AceChen1 @Huanxin1997 默认的白名单里面不包含 style 属性,只要自定义白名单的时候给标签加上 style 属性即可。而 cssFilter 是用于控制在允许 style 的情况下,是否要做进一步的样式过滤。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants