526 lines
23 KiB
HTML
526 lines
23 KiB
HTML
|
|
<!doctype html>
|
|
<html lang="en">
|
|
|
|
<head>
|
|
<title>Code coverage report for utils/sanitize.ts</title>
|
|
<meta charset="utf-8" />
|
|
<link rel="stylesheet" href="../prettify.css" />
|
|
<link rel="stylesheet" href="../base.css" />
|
|
<link rel="shortcut icon" type="image/x-icon" href="../favicon.png" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<style type='text/css'>
|
|
.coverage-summary .sorter {
|
|
background-image: url(../sort-arrow-sprite.png);
|
|
}
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
<div class='wrapper'>
|
|
<div class='pad1'>
|
|
<h1><a href="../index.html">All files</a> / <a href="index.html">utils</a> sanitize.ts</h1>
|
|
<div class='clearfix'>
|
|
|
|
<div class='fl pad1y space-right2'>
|
|
<span class="strong">0% </span>
|
|
<span class="quiet">Statements</span>
|
|
<span class='fraction'>0/44</span>
|
|
</div>
|
|
|
|
|
|
<div class='fl pad1y space-right2'>
|
|
<span class="strong">0% </span>
|
|
<span class="quiet">Branches</span>
|
|
<span class='fraction'>0/43</span>
|
|
</div>
|
|
|
|
|
|
<div class='fl pad1y space-right2'>
|
|
<span class="strong">0% </span>
|
|
<span class="quiet">Functions</span>
|
|
<span class='fraction'>0/5</span>
|
|
</div>
|
|
|
|
|
|
<div class='fl pad1y space-right2'>
|
|
<span class="strong">0% </span>
|
|
<span class="quiet">Lines</span>
|
|
<span class='fraction'>0/44</span>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
<p class="quiet">
|
|
Press <em>n</em> or <em>j</em> to go to the next uncovered block, <em>b</em>, <em>p</em> or <em>k</em> for the previous block.
|
|
</p>
|
|
<template id="filterTemplate">
|
|
<div class="quiet">
|
|
Filter:
|
|
<input type="search" id="fileSearch">
|
|
</div>
|
|
</template>
|
|
</div>
|
|
<div class='status-line low'></div>
|
|
<pre><table class="coverage">
|
|
<tr><td class="line-count quiet"><a name='L1'></a><a href='#L1'>1</a>
|
|
<a name='L2'></a><a href='#L2'>2</a>
|
|
<a name='L3'></a><a href='#L3'>3</a>
|
|
<a name='L4'></a><a href='#L4'>4</a>
|
|
<a name='L5'></a><a href='#L5'>5</a>
|
|
<a name='L6'></a><a href='#L6'>6</a>
|
|
<a name='L7'></a><a href='#L7'>7</a>
|
|
<a name='L8'></a><a href='#L8'>8</a>
|
|
<a name='L9'></a><a href='#L9'>9</a>
|
|
<a name='L10'></a><a href='#L10'>10</a>
|
|
<a name='L11'></a><a href='#L11'>11</a>
|
|
<a name='L12'></a><a href='#L12'>12</a>
|
|
<a name='L13'></a><a href='#L13'>13</a>
|
|
<a name='L14'></a><a href='#L14'>14</a>
|
|
<a name='L15'></a><a href='#L15'>15</a>
|
|
<a name='L16'></a><a href='#L16'>16</a>
|
|
<a name='L17'></a><a href='#L17'>17</a>
|
|
<a name='L18'></a><a href='#L18'>18</a>
|
|
<a name='L19'></a><a href='#L19'>19</a>
|
|
<a name='L20'></a><a href='#L20'>20</a>
|
|
<a name='L21'></a><a href='#L21'>21</a>
|
|
<a name='L22'></a><a href='#L22'>22</a>
|
|
<a name='L23'></a><a href='#L23'>23</a>
|
|
<a name='L24'></a><a href='#L24'>24</a>
|
|
<a name='L25'></a><a href='#L25'>25</a>
|
|
<a name='L26'></a><a href='#L26'>26</a>
|
|
<a name='L27'></a><a href='#L27'>27</a>
|
|
<a name='L28'></a><a href='#L28'>28</a>
|
|
<a name='L29'></a><a href='#L29'>29</a>
|
|
<a name='L30'></a><a href='#L30'>30</a>
|
|
<a name='L31'></a><a href='#L31'>31</a>
|
|
<a name='L32'></a><a href='#L32'>32</a>
|
|
<a name='L33'></a><a href='#L33'>33</a>
|
|
<a name='L34'></a><a href='#L34'>34</a>
|
|
<a name='L35'></a><a href='#L35'>35</a>
|
|
<a name='L36'></a><a href='#L36'>36</a>
|
|
<a name='L37'></a><a href='#L37'>37</a>
|
|
<a name='L38'></a><a href='#L38'>38</a>
|
|
<a name='L39'></a><a href='#L39'>39</a>
|
|
<a name='L40'></a><a href='#L40'>40</a>
|
|
<a name='L41'></a><a href='#L41'>41</a>
|
|
<a name='L42'></a><a href='#L42'>42</a>
|
|
<a name='L43'></a><a href='#L43'>43</a>
|
|
<a name='L44'></a><a href='#L44'>44</a>
|
|
<a name='L45'></a><a href='#L45'>45</a>
|
|
<a name='L46'></a><a href='#L46'>46</a>
|
|
<a name='L47'></a><a href='#L47'>47</a>
|
|
<a name='L48'></a><a href='#L48'>48</a>
|
|
<a name='L49'></a><a href='#L49'>49</a>
|
|
<a name='L50'></a><a href='#L50'>50</a>
|
|
<a name='L51'></a><a href='#L51'>51</a>
|
|
<a name='L52'></a><a href='#L52'>52</a>
|
|
<a name='L53'></a><a href='#L53'>53</a>
|
|
<a name='L54'></a><a href='#L54'>54</a>
|
|
<a name='L55'></a><a href='#L55'>55</a>
|
|
<a name='L56'></a><a href='#L56'>56</a>
|
|
<a name='L57'></a><a href='#L57'>57</a>
|
|
<a name='L58'></a><a href='#L58'>58</a>
|
|
<a name='L59'></a><a href='#L59'>59</a>
|
|
<a name='L60'></a><a href='#L60'>60</a>
|
|
<a name='L61'></a><a href='#L61'>61</a>
|
|
<a name='L62'></a><a href='#L62'>62</a>
|
|
<a name='L63'></a><a href='#L63'>63</a>
|
|
<a name='L64'></a><a href='#L64'>64</a>
|
|
<a name='L65'></a><a href='#L65'>65</a>
|
|
<a name='L66'></a><a href='#L66'>66</a>
|
|
<a name='L67'></a><a href='#L67'>67</a>
|
|
<a name='L68'></a><a href='#L68'>68</a>
|
|
<a name='L69'></a><a href='#L69'>69</a>
|
|
<a name='L70'></a><a href='#L70'>70</a>
|
|
<a name='L71'></a><a href='#L71'>71</a>
|
|
<a name='L72'></a><a href='#L72'>72</a>
|
|
<a name='L73'></a><a href='#L73'>73</a>
|
|
<a name='L74'></a><a href='#L74'>74</a>
|
|
<a name='L75'></a><a href='#L75'>75</a>
|
|
<a name='L76'></a><a href='#L76'>76</a>
|
|
<a name='L77'></a><a href='#L77'>77</a>
|
|
<a name='L78'></a><a href='#L78'>78</a>
|
|
<a name='L79'></a><a href='#L79'>79</a>
|
|
<a name='L80'></a><a href='#L80'>80</a>
|
|
<a name='L81'></a><a href='#L81'>81</a>
|
|
<a name='L82'></a><a href='#L82'>82</a>
|
|
<a name='L83'></a><a href='#L83'>83</a>
|
|
<a name='L84'></a><a href='#L84'>84</a>
|
|
<a name='L85'></a><a href='#L85'>85</a>
|
|
<a name='L86'></a><a href='#L86'>86</a>
|
|
<a name='L87'></a><a href='#L87'>87</a>
|
|
<a name='L88'></a><a href='#L88'>88</a>
|
|
<a name='L89'></a><a href='#L89'>89</a>
|
|
<a name='L90'></a><a href='#L90'>90</a>
|
|
<a name='L91'></a><a href='#L91'>91</a>
|
|
<a name='L92'></a><a href='#L92'>92</a>
|
|
<a name='L93'></a><a href='#L93'>93</a>
|
|
<a name='L94'></a><a href='#L94'>94</a>
|
|
<a name='L95'></a><a href='#L95'>95</a>
|
|
<a name='L96'></a><a href='#L96'>96</a>
|
|
<a name='L97'></a><a href='#L97'>97</a>
|
|
<a name='L98'></a><a href='#L98'>98</a>
|
|
<a name='L99'></a><a href='#L99'>99</a>
|
|
<a name='L100'></a><a href='#L100'>100</a>
|
|
<a name='L101'></a><a href='#L101'>101</a>
|
|
<a name='L102'></a><a href='#L102'>102</a>
|
|
<a name='L103'></a><a href='#L103'>103</a>
|
|
<a name='L104'></a><a href='#L104'>104</a>
|
|
<a name='L105'></a><a href='#L105'>105</a>
|
|
<a name='L106'></a><a href='#L106'>106</a>
|
|
<a name='L107'></a><a href='#L107'>107</a>
|
|
<a name='L108'></a><a href='#L108'>108</a>
|
|
<a name='L109'></a><a href='#L109'>109</a>
|
|
<a name='L110'></a><a href='#L110'>110</a>
|
|
<a name='L111'></a><a href='#L111'>111</a>
|
|
<a name='L112'></a><a href='#L112'>112</a>
|
|
<a name='L113'></a><a href='#L113'>113</a>
|
|
<a name='L114'></a><a href='#L114'>114</a>
|
|
<a name='L115'></a><a href='#L115'>115</a>
|
|
<a name='L116'></a><a href='#L116'>116</a>
|
|
<a name='L117'></a><a href='#L117'>117</a>
|
|
<a name='L118'></a><a href='#L118'>118</a>
|
|
<a name='L119'></a><a href='#L119'>119</a>
|
|
<a name='L120'></a><a href='#L120'>120</a>
|
|
<a name='L121'></a><a href='#L121'>121</a>
|
|
<a name='L122'></a><a href='#L122'>122</a>
|
|
<a name='L123'></a><a href='#L123'>123</a>
|
|
<a name='L124'></a><a href='#L124'>124</a>
|
|
<a name='L125'></a><a href='#L125'>125</a>
|
|
<a name='L126'></a><a href='#L126'>126</a>
|
|
<a name='L127'></a><a href='#L127'>127</a>
|
|
<a name='L128'></a><a href='#L128'>128</a>
|
|
<a name='L129'></a><a href='#L129'>129</a>
|
|
<a name='L130'></a><a href='#L130'>130</a>
|
|
<a name='L131'></a><a href='#L131'>131</a>
|
|
<a name='L132'></a><a href='#L132'>132</a>
|
|
<a name='L133'></a><a href='#L133'>133</a>
|
|
<a name='L134'></a><a href='#L134'>134</a>
|
|
<a name='L135'></a><a href='#L135'>135</a>
|
|
<a name='L136'></a><a href='#L136'>136</a>
|
|
<a name='L137'></a><a href='#L137'>137</a>
|
|
<a name='L138'></a><a href='#L138'>138</a>
|
|
<a name='L139'></a><a href='#L139'>139</a>
|
|
<a name='L140'></a><a href='#L140'>140</a>
|
|
<a name='L141'></a><a href='#L141'>141</a>
|
|
<a name='L142'></a><a href='#L142'>142</a>
|
|
<a name='L143'></a><a href='#L143'>143</a>
|
|
<a name='L144'></a><a href='#L144'>144</a>
|
|
<a name='L145'></a><a href='#L145'>145</a>
|
|
<a name='L146'></a><a href='#L146'>146</a>
|
|
<a name='L147'></a><a href='#L147'>147</a>
|
|
<a name='L148'></a><a href='#L148'>148</a></td><td class="line-coverage quiet"><span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-no"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span>
|
|
<span class="cline-any cline-neutral"> </span></td><td class="text"><pre class="prettyprint lang-js">/**
|
|
* Utilidades de Sanitización
|
|
* Previene ataques XSS en frontend
|
|
*/
|
|
|
|
import DOMPurify from 'dompurify';
|
|
|
|
/**
|
|
* Sanitizar HTML permitiendo solo tags seguros
|
|
*/
|
|
export function <span class="fstat-no" title="function not covered" >sanitizeHTML(h</span>tml: string): string {
|
|
<span class="cstat-no" title="statement not covered" > if (typeof window === 'undefined') {</span>
|
|
// En SSR, retornar string vacío (no hay DOM)
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
|
|
<span class="cstat-no" title="statement not covered" > return DOMPurify.sanitize(html, {</span>
|
|
ALLOWED_TAGS: [
|
|
'p', 'br', 'strong', 'em', 'b', 'i', 'u', 's',
|
|
'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
|
|
'ul', 'ol', 'li',
|
|
'blockquote', 'pre', 'code',
|
|
'a', 'img',
|
|
'table', 'thead', 'tbody', 'tr', 'th', 'td',
|
|
'div', 'span',
|
|
],
|
|
ALLOWED_ATTR: [
|
|
'href', 'title', 'alt', 'src', 'class', 'id',
|
|
'data-*', // Permitir atributos data-* para compatibilidad
|
|
],
|
|
ALLOW_DATA_ATTR: true,
|
|
ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i,
|
|
KEEP_CONTENT: true,
|
|
RETURN_DOM: false,
|
|
RETURN_DOM_FRAGMENT: false,
|
|
RETURN_TRUSTED_TYPE: false,
|
|
SAFE_FOR_TEMPLATES: false,
|
|
SANITIZE_DOM: true,
|
|
SANITIZE_NAMED_PROPS: false,
|
|
USE_PROFILES: { html: true },
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Sanitizar texto plano (eliminar HTML completamente)
|
|
*/
|
|
export function <span class="fstat-no" title="function not covered" >sanitizeText(t</span>ext: string): string {
|
|
<span class="cstat-no" title="statement not covered" > if (typeof window === 'undefined') {</span>
|
|
<span class="cstat-no" title="statement not covered" > return text;</span>
|
|
}
|
|
|
|
// Crear un div temporal para extraer solo texto
|
|
const div = <span class="cstat-no" title="statement not covered" >document.createElement('div');</span>
|
|
<span class="cstat-no" title="statement not covered" > div.textContent = text;</span>
|
|
<span class="cstat-no" title="statement not covered" > return div.textContent || div.innerText || '';</span>
|
|
}
|
|
|
|
/**
|
|
* Sanitizar URL para prevenir javascript: y otros protocolos peligrosos
|
|
*/
|
|
export function <span class="fstat-no" title="function not covered" >sanitizeURL(u</span>rl: string): string {
|
|
<span class="cstat-no" title="statement not covered" > if (!url || typeof url !== 'string') {</span>
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
|
|
// Normalizar espacios
|
|
<span class="cstat-no" title="statement not covered" > url = url.trim();</span>
|
|
|
|
// Bloquear protocolos peligrosos
|
|
const dangerousProtocols = <span class="cstat-no" title="statement not covered" >['javascript:', 'data:', 'vbscript:', 'file:', 'about:'];</span>
|
|
const lowerUrl = <span class="cstat-no" title="statement not covered" >url.toLowerCase();</span>
|
|
|
|
<span class="cstat-no" title="statement not covered" > for (const protocol of dangerousProtocols) {</span>
|
|
<span class="cstat-no" title="statement not covered" > if (lowerUrl.startsWith(protocol)) {</span>
|
|
<span class="cstat-no" title="statement not covered" > console.warn(`⚠️ URL bloqueada por protocolo peligroso: ${url}`);</span>
|
|
<span class="cstat-no" title="statement not covered" > return '#';</span>
|
|
}
|
|
}
|
|
|
|
// Permitir solo http, https, mailto, tel
|
|
<span class="cstat-no" title="statement not covered" > if (!/^(https?|mailto|tel|#):/.test(url)) {</span>
|
|
// Si no tiene protocolo, asumir relativa (segura)
|
|
<span class="cstat-no" title="statement not covered" > if (!url.startsWith('/') && !url.startsWith('./') && !url.startsWith('../')) {</span>
|
|
<span class="cstat-no" title="statement not covered" > return `/${url}`;</span>
|
|
}
|
|
<span class="cstat-no" title="statement not covered" > return url;</span>
|
|
}
|
|
|
|
<span class="cstat-no" title="statement not covered" > return url;</span>
|
|
}
|
|
|
|
/**
|
|
* Sanitizar atributo src de imagen
|
|
*/
|
|
export function <span class="fstat-no" title="function not covered" >sanitizeImageSrc(s</span>rc: string): string {
|
|
<span class="cstat-no" title="statement not covered" > if (!src || typeof src !== 'string') {</span>
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
|
|
// Normalizar espacios
|
|
<span class="cstat-no" title="statement not covered" > src = src.trim();</span>
|
|
|
|
// Bloquear protocolos peligrosos
|
|
const dangerousProtocols = <span class="cstat-no" title="statement not covered" >['javascript:', 'data:', 'vbscript:'];</span>
|
|
const lowerSrc = <span class="cstat-no" title="statement not covered" >src.toLowerCase();</span>
|
|
|
|
<span class="cstat-no" title="statement not covered" > for (const protocol of dangerousProtocols) {</span>
|
|
<span class="cstat-no" title="statement not covered" > if (lowerSrc.startsWith(protocol)) {</span>
|
|
<span class="cstat-no" title="statement not covered" > console.warn(`⚠️ Image src bloqueada por protocolo peligroso: ${src}`);</span>
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
}
|
|
|
|
// Permitir data URIs para imágenes base64 (necesario para algunas funcionalidades)
|
|
<span class="cstat-no" title="statement not covered" > if (src.startsWith('data:image/')) {</span>
|
|
// Validar que sea realmente una imagen
|
|
const validImageTypes = <span class="cstat-no" title="statement not covered" >['image/png', 'image/jpeg', 'image/jpg', 'image/gif', 'image/webp', 'image/svg+xml'];</span>
|
|
const matches = <span class="cstat-no" title="statement not covered" >src.match(/^data:(image\/[a-z0-9+]+);base64,/i);</span>
|
|
<span class="cstat-no" title="statement not covered" > if (matches && validImageTypes.includes(matches[1].toLowerCase())) {</span>
|
|
<span class="cstat-no" title="statement not covered" > return src; /</span>/ Data URI válido
|
|
}
|
|
<span class="cstat-no" title="statement not covered" > console.warn(`⚠️ Data URI inválido bloqueado: ${src.substring(0, 50)}...`);</span>
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
|
|
// Permitir http, https, y rutas relativas
|
|
<span class="cstat-no" title="statement not covered" > if (src.startsWith('http://') || src.startsWith('https://') || src.startsWith('/') || src.startsWith('./') || src.startsWith('../')) {</span>
|
|
<span class="cstat-no" title="statement not covered" > return src;</span>
|
|
}
|
|
|
|
// Si no tiene protocolo ni ruta, asumir relativa desde public/
|
|
<span class="cstat-no" title="statement not covered" > return `/${src}`;</span>
|
|
}
|
|
|
|
/**
|
|
* Sanitizar atributo alt de imagen
|
|
*/
|
|
export function <span class="fstat-no" title="function not covered" >sanitizeImageAlt(a</span>lt: string | null | undefined): string {
|
|
<span class="cstat-no" title="statement not covered" > if (!alt || typeof alt !== 'string') {</span>
|
|
<span class="cstat-no" title="statement not covered" > return '';</span>
|
|
}
|
|
|
|
// Sanitizar como texto plano (sin HTML)
|
|
<span class="cstat-no" title="statement not covered" > return sanitizeText(alt).slice(0, 200); /</span>/ Limitar longitud
|
|
}
|
|
|
|
|
|
</pre></td></tr></table></pre>
|
|
|
|
<div class='push'></div><!-- for sticky footer -->
|
|
</div><!-- /wrapper -->
|
|
<div class='footer quiet pad2 space-top1 center small'>
|
|
Code coverage generated by
|
|
<a href="https://istanbul.js.org/" target="_blank" rel="noopener noreferrer">istanbul</a>
|
|
at 2026-01-11T10:26:27.205Z
|
|
</div>
|
|
<script src="../prettify.js"></script>
|
|
<script>
|
|
window.onload = function () {
|
|
prettyPrint();
|
|
};
|
|
</script>
|
|
<script src="../sorter.js"></script>
|
|
<script src="../block-navigation.js"></script>
|
|
</body>
|
|
</html>
|
|
|