| 1 |
export const sanitizeString = (value) => { |
| 2 |
if (!value) return ''; |
| 3 |
|
| 4 |
const DISALLOWED_TAGS = [ |
| 5 |
'script', |
| 6 |
'iframe', |
| 7 |
'object', |
| 8 |
'embed', |
| 9 |
'form', |
| 10 |
'meta', |
| 11 |
'link', |
| 12 |
'style', |
| 13 |
'svg', |
| 14 |
]; |
| 15 |
|
| 16 |
const DISALLOWED_PATTERNS = [ |
| 17 |
`<\\/*\\s*(${DISALLOWED_TAGS.join('|')})\\b[^>]*>`, |
| 18 |
'javascript:', |
| 19 |
'data:', |
| 20 |
]; |
| 21 |
|
| 22 |
let sanitizedValue = value.trim(); |
| 23 |
|
| 24 |
DISALLOWED_PATTERNS.forEach((pattern) => { |
| 25 |
const patternRegex = new RegExp(pattern, 'gi'); |
| 26 |
sanitizedValue = sanitizedValue.replace(patternRegex, ''); |
| 27 |
}); |
| 28 |
|
| 29 |
return sanitizedValue; |
| 30 |
}; |
| 31 |
|
