Skip to content
This repository was archived by the owner on Jul 15, 2019. It is now read-only.

Releases: YahooArchive/xss-filters

Refreshed devDependencies and resolved build issues

Choose a tag to compare

@adon-at-work adon-at-work released this 12 Sep 19:58
  • updated devDependencies
  • fixed uglify settings to preserve \x0B for IE8
  • updated email addresses of authors
  • updated travis nodejs versions
  • updated npm deploy api key

Enhanced css filters for IE

Choose a tag to compare

@adon-at-work adon-at-work released this 29 Jul 10:47
  • enhanced css filters for IE
  • blacklisted x-schema protocol

Fix IE compatibility issues on splicing arguments

Choose a tag to compare

@adon-at-work adon-at-work released this 10 Jul 10:14
v1.2.4

Fix IE compatibility issues on splicing arguments

Fixed blacklist protocol check and unquoted filters

Choose a tag to compare

@adon-at-work adon-at-work released this 07 Jul 13:38
v1.2.3

fixed blacklist protocol check and unquoted filters

Support CSS Filtering in Private Filters

Choose a tag to compare

@neraliu neraliu released this 03 Jun 06:08
  • Support a new set of css private filters for secure-handlebars

Improved Compatibility with Older Browsers

Choose a tag to compare

@adon-at-work adon-at-work released this 29 May 02:58
release as version 1.1.2

resolve a cross-browser compatibility issue (array.indexOf() is not
supported by old IEs)

Improved Security and Compatibility with Older Browsers

Choose a tag to compare

@adon-at-work adon-at-work released this 26 Mar 10:36

Improved Security and Compatibility with Older Browsers

Choose a tag to compare

@adon-at-work adon-at-work released this 26 Mar 10:31
  • null handling in yc() and yavu()
  • yavu() optimized and caught all null cases
  • exposed yup() to retrieve protocol (some false positives for &#0, but acceptable)
  • yubl() updated to prefix x- before javascript:, vbscript:, data:, and mhtml:

Improved Security and Compatibility with Older Browsers

Choose a tag to compare

@adon-at-work adon-at-work released this 21 Mar 04:46
  • treated grave accent ` handling in y() and yavu()
  • escaped tab and newline in numeric values ( instead of and instead of ) for compatibility with older browsers
  • improved speed of yubl() based on http://jsperf.com/lazy-regexp-parsing
  • code cleanup to shrink space

Security fix

Choose a tag to compare

@adon-at-work adon-at-work released this 09 Mar 09:49
  • fixed: check : too, otherwise could bypass yubl()