Js XSS Solution

by ph822720355

HTML

<body>
  
  <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/1.0.3/purify.min.js"></script>
</body>

JavaScript

function sanitize(htmlString) {
  return DOMPurify.sanitize(htmlString);
}

// 使用範例
const aboutUser = `I have bad intentions <img src="http://unsplash.it/100/100?random"
onload="alert('受到攻擊XSS!');" />`;

const html = sanitize(`<h3>${aboutUser}</h3>`);

const about = document.querySelector("body");

// 測試: 未處理過
//about.innerHTML = aboutUser;

// 測試: 處理過
about.innerHTML = html;