java 富文本 过滤xss_集成富文本编辑器XSS预防过滤措施

import re

import copy

from html.parser import HTMLParser

class XSSHtml(HTMLParser):

allow_tags = [‘a‘, ‘img‘, ‘br‘, ‘strong‘, ‘b‘, ‘code‘, ‘pre‘,

‘p‘, ‘div‘, ‘em‘, ‘span‘, ‘h1‘, ‘h2‘, ‘h3‘, ‘h4‘,

‘h5‘, ‘h6‘, ‘blockquote‘, ‘ul‘, ‘ol‘, ‘tr‘, ‘th‘, ‘td‘,

‘hr‘, ‘li‘, ‘u‘, ‘embed‘, ‘s‘, ‘table‘, ‘thead‘, ‘tbody‘,

‘caption‘, ‘small‘, ‘q‘, ‘sup‘, ‘sub‘, ‘font‘]

common_attrs = ["style", "class", "name"]

nonend_tags = ["img", "hr", "br", "embed"]

tags_own_attrs = {

"img": ["src", "width", "height", "alt", "align"],

"a": ["href", "target", "rel", "title"],

"embed": ["src", "width", "height", "type", "allowfullscreen", "loop", "play", "wmode", "menu"],

"table": ["border", "cellpadding", "cellspacing"],

"font": ["color"]

}

def __init__(self, allows=[]):

HTMLParser.__init__(self)

self.allow_tags = allows if allows else self.allow_tags

self.result = [