haskell/xss-sanitize
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

attoparsec 0.10

Browse Source
This commit is contained in:
Michael Snoyman 2011-11-28 19:55:28 +02:00
parent e2b69ffe7a
commit 9c901f5785
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Text/HTML/SanitizeXSS/Css.hs
View File

@ -12,7 +12,7 @@ import Data.Attoparsec.Text
import Data.Text.Lazy.Builder (toLazyText) import Data.Text.Lazy.Builder (toLazyText)
import Data.Text.Lazy (toStrict) import Data.Text.Lazy (toStrict)
import Data.Set (member, fromList, Set) import Data.Set (member, fromList, Set)
import Data.Char (isDigit) import Data.Char (isDigit, isSpace)
import Control.Applicative ((<|>), pure) import Control.Applicative ((<|>), pure)
import Text.CSS.Render (renderAttrs) import Text.CSS.Render (renderAttrs)
import Text.CSS.Parse (parseAttrs) import Text.CSS.Parse (parseAttrs)
@ -38,7 +38,7 @@ sanitizeCSS css = toStrict . toLazyText .
rejectUrl = do rejectUrl = do
pre <- manyTill anyChar (string "url") pre <- manyTill anyChar (string "url")
skipMany space skipWhile isSpace
_<-char '(' _<-char '('
skipWhile (/= ')') skipWhile (/= ')')
_<-char ')' _<-char ')'
@ -82,11 +82,11 @@ allowedCssAttributeValue val =
-- should have used sepBy (symbol ",") -- should have used sepBy (symbol ",")
rgb = do rgb = do
_<- string "rgb(" _<- string "rgb("
skipMany1 digit >> skipOk (== '%') skipWhile1 isDigit >> skipOk (== '%')
skip (== ',') skip (== ',')
skipMany digit >> skipOk (== '%') skipWhile1 isDigit >> skipOk (== '%')
skip (== ',') skip (== ',')
skipMany digit >> skipOk (== '%') skipWhile1 isDigit >> skipOk (== '%')
skip (== ')') skip (== ')')
return True return True
@ -95,7 +95,7 @@ allowedCssAttributeValue val =
skipOk isDigit skipOk isDigit
skipOk (== '.') skipOk (== '.')
skipOk isDigit >> skipOk isDigit skipOk isDigit >> skipOk isDigit
skipSpace skipWhile isSpace
unit <- takeText unit <- takeText
return $ T.null unit || unit `member` allowed_css_attribute_value_units return $ T.null unit || unit `member` allowed_css_attribute_value_units
@ -138,3 +138,6 @@ allowed_svg_properties = fromList acceptable_svg_properties
acceptable_svg_properties = [ "fill", "fill-opacity", "fill-rule", acceptable_svg_properties = [ "fill", "fill-opacity", "fill-rule",
"stroke", "stroke-width", "stroke-linecap", "stroke-linejoin", "stroke", "stroke-width", "stroke-linecap", "stroke-linejoin",
"stroke-opacity"] "stroke-opacity"]
skipWhile1 :: (Char -> Bool) -> Parser ()
skipWhile1 f = skip f >> skipWhile f

2
xss-sanitize.cabal
View File

@ -20,7 +20,7 @@ library
, network >= 2 , network >= 2
, css-text >= 0.1 && < 0.2 , css-text >= 0.1 && < 0.2
, text >= 0.11 && < 0.12 , text >= 0.11 && < 0.12
, attoparsec-text >= 0.8.5.1 && < 0.9 , attoparsec >= 0.10 && < 0.11
exposed-modules: Text.HTML.SanitizeXSS exposed-modules: Text.HTML.SanitizeXSS