Fix regular expressions in isValidXss

lib/helpers/isValidXss.js

@@ -1,7 +1,8 @@
 'use strict';
 
 module.exports = function isValidXss(requestURL) {
-  var xssRegex = /(\b)(on\w+)=|javascript|(<\s*)(\/*)script/gi;
-  return xssRegex.test(requestURL);
+  var xssEventRegex = /(\b)on(click|error|load|mouse\w+|key\w+|focus\w?|blur|change|input|drag\w?|resize|dbclick|contextmenu|drop|select|message|scroll)=/;
+  var xssJSRegex = /javascript:|(<\s*)(\/*)script/gi;
+  return xssJSRegex.test(requestURL) || xssEventRegex.test(requestURL);
 };
 

test/specs/helpers/isValidXss.spec.js

@@ -8,10 +8,16 @@ describe('helpers::isValidXss', function () {
     expect(isValidXss("<img src='/' onerror='javascript:alert('xss')'>xss</script>")).toBe(true);
     expect(isValidXss("<script>console.log('XSS')</script>")).toBe(true);
     expect(isValidXss("onerror=alert('XSS')")).toBe(true);
+    expect(isValidXss("onmouseover=alert('XSS')")).toBe(true);
+    expect(isValidXss("onkeyup=alert('XSS')")).toBe(true);
     expect(isValidXss("<a onclick='alert('XSS')'>Click Me</a>")).toBe(true);
   });
 
   it('should not detect non script tags', function() {
+    expect(isValidXss("javascript.com")).toBe(false);
+    expect(isValidXss("abc.com/javascript/path")).toBe(false);
+    expect(isValidXss("abc.com?tag=javascript")).toBe(false);
+    expect(isValidXss("only=true")).toBe(false);
     expect(isValidXss("/one/?foo=bar")).toBe(false);
     expect(isValidXss("<safe> tags")).toBe(false);
     expect(isValidXss("<safetag>")).toBe(false);