diff --git a/lib/helpers/isValidXss.js b/lib/helpers/isValidXss.js
index 3c834a7cfa..109756be08 100644
--- a/lib/helpers/isValidXss.js
+++ b/lib/helpers/isValidXss.js
@@ -1,7 +1,8 @@
'use strict';
module.exports = function isValidXss(requestURL) {
- var xssRegex = /(\b)(on\w+)=|javascript|(<\s*)(\/*)script/gi;
- return xssRegex.test(requestURL);
+ var xssEventRegex = /(\b)on(click|error|load|mouse\w+|key\w+|focus\w?|blur|change|input|drag\w?|touch\w+|resize|dbclick|contextmenu|drop|select|message|scroll)=/gi;
+ var xssJSRegex = /javascript:|(<\s*)(\/*)script/gi;
+ return xssJSRegex.test(requestURL) || xssEventRegex.test(requestURL);
};
diff --git a/test/specs/helpers/isValidXss.spec.js b/test/specs/helpers/isValidXss.spec.js
index dcfcf9d772..52f68d7a79 100644
--- a/test/specs/helpers/isValidXss.spec.js
+++ b/test/specs/helpers/isValidXss.spec.js
@@ -8,10 +8,16 @@ describe('helpers::isValidXss', function () {
expect(isValidXss("xss")).toBe(true);
expect(isValidXss("")).toBe(true);
expect(isValidXss("onerror=alert('XSS')")).toBe(true);
+ expect(isValidXss("onMouseOver=alert('XSS')")).toBe(true);
+ expect(isValidXss("onkeyup=alert('XSS')")).toBe(true);
expect(isValidXss("Click Me")).toBe(true);
});
it('should not detect non script tags', function() {
+ expect(isValidXss("javascript.com")).toBe(false);
+ expect(isValidXss("abc.com/javascript/path")).toBe(false);
+ expect(isValidXss("abc.com?tag=javascript")).toBe(false);
+ expect(isValidXss("only=true")).toBe(false);
expect(isValidXss("/one/?foo=bar")).toBe(false);
expect(isValidXss(" tags")).toBe(false);
expect(isValidXss("")).toBe(false);