資安 DOM 處理 DOm purify

by ph822720355

HTML

<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/0.8.2/purify.min.js"></script>
  <p id="sanitized"></p>

JavaScript

function sanitize(htmlString) {
  return DOMPurify.sanitize(htmlString);
}

// 使用範例
const aboutUser = `I have bad intentions <img src="http://unsplash.it/100/100?random"
onload="alert('your account has been compromised');" />`;

const html = sanitize(`<h3>${aboutUser}</h3>`);

const about = document.querySelector("body");

// 將清理過的內容插入 DOM
about.innerHTML = html;