Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
safeAttrValue: function (tag, name, value, cssFilter) {
value = xss.safeAttrValue(tag, name, value, cssFilter)
// Remove protocol from srcs, to force https when needed
if (config.forceSafeImageURLs &&
name === 'src' &&
typeof value === 'string') {
value = value.replace(/^https?:\/\//, '//')
}
// Parse iframe's to only allow video embeds
if (tag === 'iframe' && name === 'src') {
var video = videoUrlInspector(value)
value = video ? video.embedUrl : ''
}
return value
}
safeAttrValue: (
tag: string,
name: string,
value: string,
cssFilter: XSS.ICSSFilter
): string => {
// Take over safe attribute filtering for `a` `href`, `img` `src`,
// `audio` `src`, and `video` `src` attributes, otherwise pass onto the
// default `XSS.safeAttrValue` method.
if (
(tag === 'a' && name === 'href') ||
((tag === 'img' || tag === 'audio' || tag === 'video') && name === 'src')
) {
return this.sanitizeUrl(value);
}
return xss.safeAttrValue(tag, name, value, cssFilter);
}
};