{"_id":"@barkleapp/css-sanitizer","name":"@barkleapp/css-sanitizer","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@barkleapp/css-sanitizer","version":"1.0.0","description":"A CSS sanitizer to prevent XSS attacks","main":"src/index.js","scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"keywords":["css","sanitizer","security","xss"],"author":{"name":"BanditCo"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/barkleapp/css-sanitizer.git"},"_id":"@barkleapp/css-sanitizer@1.0.0","gitHead":"4304f64a2a2cd63d33e0d4941f2b142b0bfb326f","bugs":{"url":"https://github.com/barkleapp/css-sanitizer/issues"},"homepage":"https://github.com/barkleapp/css-sanitizer#readme","_nodeVersion":"20.15.1","_npmVersion":"10.7.0","dist":{"integrity":"sha512-22hnMrxMg9BMF8A53LuZ2MEtOwPAziOg9xAoOTcgCSaiB5K9fdbTxUvYkueZki5GSy3PHgIHrPjarqkhhfbiJA==","shasum":"88505440e0033ae320989e1118f334b2139339f8","tarball":"https://registry.npmjs.org/@barkleapp/css-sanitizer/-/css-sanitizer-1.0.0.tgz","fileCount":4,"unpackedSize":9890,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIC0sZTxn2Gs5+MOw9pA4hgc5VOCw12fd5hZB6qSYIcSOAiEAnxUeofPUSrd20XQlliA8Xn6vV/srPU28lGNo3d78194="}]},"_npmUser":{"name":"aidanthebandit","email":"aidan@banditco.dev"},"directories":{},"maintainers":[{"name":"aidanthebandit","email":"aidan@banditco.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/css-sanitizer_1.0.0_1723341777230_0.9595917909629241"},"_hasShrinkwrap":false}},"time":{"created":"2024-08-11T02:02:57.163Z","1.0.0":"2024-08-11T02:02:57.430Z","modified":"2024-08-11T02:02:57.678Z"},"maintainers":[{"name":"aidanthebandit","email":"aidan@banditco.dev"}],"description":"A CSS sanitizer to prevent XSS attacks","homepage":"https://github.com/barkleapp/css-sanitizer#readme","keywords":["css","sanitizer","security","xss"],"repository":{"type":"git","url":"git+https://github.com/barkleapp/css-sanitizer.git"},"author":{"name":"BanditCo"},"bugs":{"url":"https://github.com/barkleapp/css-sanitizer/issues"},"license":"MIT","readme":"# CSS Sanitizer\n\nA lightweight, configurable CSS sanitizer to prevent XSS attacks by filtering out potentially harmful CSS properties and values.\n\n## Installation\n\n```bash\nnpm install @barkleapp/css-sanitizer\n```\n\n## Usage\n\n### Basic Usage\n\n```javascript\nimport { CssSanitizer } from 'css-sanitizer';\n\nconst sanitizer = new CssSanitizer();\n\nconst unsanitizedCss = `\n  body {\n    background: url('https://example.com/image.jpg');\n    color: red;\n  }\n`;\n\nconst sanitizedCss = sanitizer.sanitizeCss(unsanitizedCss);\nconsole.log(sanitizedCss);\n```\n\n### Custom Configuration\n\nYou can customize the sanitizer's behavior by passing a configuration object:\n\n```javascript\nconst customSanitizer = new CssSanitizer({\n  maxCssLength: 100000,\n  allowedProperties: ['custom-property'],\n  allowedAtRules: ['@custom-media'],\n  allowedPseudoClasses: [':has'],\n  validateUrl: (url) => {\n    // Custom URL validation logic\n    return url.startsWith('https://');\n  },\n  sanitizeUrl: (url) => {\n    // Custom URL sanitization logic\n    const allowedDomains = ['example.com', 'trusteddomain.com'];\n    const parsedUrl = new URL(url);\n    if (allowedDomains.includes(parsedUrl.hostname)) {\n      return url;\n    }\n    return '';\n  }\n});\n```\n\n## API\n\n### `CssSanitizer`\n\nThe main class for sanitizing CSS.\n\n#### Constructor\n\n```javascript\nnew CssSanitizer(config)\n```\n\n- `config` (optional): An object with the following properties:\n  - `maxCssLength` (number): Maximum allowed length of CSS string.\n  - `allowedProperties` (Array<string>): Additional CSS properties to allow.\n  - `allowedAtRules` (Array<string>): Additional at-rules to allow.\n  - `allowedPseudoClasses` (Array<string>): Additional pseudo-classes to allow.\n  - `validateUrl` (function): Custom function to validate URLs.\n  - `sanitizeUrl` (function): Custom function to sanitize URLs.\n\n#### Methods\n\n##### `sanitizeCss(css: string): string`\n\nSanitizes the input CSS string by removing potentially harmful properties and values.\n\n- `css`: The CSS string to sanitize.\n- Returns: The sanitized CSS string.\n\n## Configuration Options\n\n### `maxCssLength` (default: 65536)\n\nMaximum allowed length of the CSS string. If the input CSS exceeds this length, it will be truncated.\n\n### `allowedProperties` (default: see code)\n\nA set of allowed CSS properties. You can add to this list by providing an array of additional properties in the constructor.\n\n### `allowedAtRules` (default: ['@media', '@keyframes', '@font-face', '@import'])\n\nA set of allowed at-rules. You can add to this list by providing an array of additional at-rules in the constructor.\n\n### `allowedPseudoClasses` (default: [':hover', ':active', ':focus', ':visited', ':first-child', ':last-child', ':nth-child', ':nth-of-type', ':not', ':before', ':after'])\n\nA set of allowed pseudo-classes. You can add to this list by providing an array of additional pseudo-classes in the constructor.\n\n### `validateUrl` (function)\n\nA function that takes a URL string and returns a boolean indicating whether the URL is valid. By default, it checks if the string can be parsed as a valid URL.\n\n### `sanitizeUrl` (function)\n\nA function that takes a URL string and returns either the sanitized URL string or an empty string if the URL is not allowed. By default, it allows URL from 'fonts.googleapis.com'.\n\n## License\n\nMIT","readmeFilename":"readme.md"}