XSS Protector

A lightweight validation and sanitization utility to detect and prevent Cross-Site Scripting (XSS) attacks in strings, arrays, and objects.

Installation

Install via npm:

npm install @cobrowser/xss-validation

Or using yarn:

yarn add @cobrowser/xss-validation

Usage

This package exports a static class, so you can call its methods directly without instantiating it.

Import

// CommonJS
const { XSSProtector } = require('@cobrowser/xss-validation');

// ES Module
import { XSSProtector } from '@cobrowser/xss-validation';

Detect XSS

XSSProtector.containsXSS(input);

Sanitize Input

XSSProtector.sanitize(input);

Both methods support:

• Strings
• Arrays of strings
• Objects with string values

Input Examples

String Input

const userInput = "<img src=javascript:alert('XSS')>";

console.log(XSSProtector.containsXSS(userInput));
// Output: true

console.log(XSSProtector.sanitize(userInput));
// Output: <img>

Array Input

const comments = ["Hello!", "<script>alert('XSS')</script>"];

console.log(XSSProtector.containsXSS(comments));
// Output: true

console.log(XSSProtector.sanitize(comments));
// Output: ["Hello!", ""]

Object Input

const formData = {
  name: "John",
  message: "<svg onload=alert(1)>"
};

console.log(XSSProtector.containsXSS(formData));
// Output: true

console.log(XSSProtector.sanitize(formData));
// Output: { name: "John", message: "<svg></svg>" }

Allowing Certain Words or Phrases

To prevent false positives, you can allow specific words or patterns by editing the internal #isFalsePositive method in the source code.

For example, to allow the word "XSS":

/XSS/i

Once added, this will prevent containsXSS from flagging "XSS" as malicious.

Note: This requires modifying the source code directly.

API Reference

XSSProtector.containsXSS(input)

• Description: Detects if the input contains XSS.
• Returns: true if XSS is detected; otherwise false.
• Supports: string | string[] | Record<string, string>

XSSProtector.sanitize(input)

• Description: Sanitizes the input, removing potentially dangerous tags and attributes.
• Returns: A sanitized version of the input in the same structure as provided.
• Supports: string | string[] | Record<string, string>

Repository & Issue Tracker

• Repository: https://bitbucket.org/cobrowser/cb_utils
• Issue Tracker: https://bitbucket.org/cobrowser/cb_utils/issues

License

This project is maintained by CoBrowser (https://cobrowser.com). License information is available in the source repository.