Separate eventRegex and JSRegex

ZeroCho · Jan 16, 2020 · 45bbe1a · 45bbe1a
1 parent 589088a
commit 45bbe1a
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/lib/helpers/isValidXss.js b/lib/helpers/isValidXss.js
@@ -1,7 +1,8 @@
 'use strict';
 
 module.exports = function isValidXss(requestURL) {
-  var xssRegex = /(\b)on(click|error|load|mouse\w+|key\w+|focus\w?|blur|change|input|drag\w?|resize)=|javascript|(<\s*)(\/*)script/gi;
-  return xssRegex.test(requestURL);
+  var xssEventRegex = /(\b)on(click|error|load|mouse\w+|key\w+|focus\w?|blur|change|input|drag\w?|resize|dbclick|contextmenu|drop|select|message)=/
+  var xssJSRegex = /javascript|(<\s*)(\/*)script/gi;
+  return xssJSRegex.test(requestURL) || xssEventRegex.test(requestURL);
 };