35 lines
879 B
Go
35 lines
879 B
Go
package validation
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/go-playground/validator/v10"
|
|
)
|
|
|
|
var xssPatterns = []*regexp.Regexp{
|
|
regexp.MustCompile(`(?i)<script`),
|
|
regexp.MustCompile(`(?i)javascript:`),
|
|
regexp.MustCompile(`(?i)on\w+\s*=`),
|
|
regexp.MustCompile(`(?i)(vbscript|data):`),
|
|
regexp.MustCompile(`(?i)<(iframe|object|embed|applet)`),
|
|
regexp.MustCompile(`(?i)expression\s*\(`),
|
|
regexp.MustCompile(`(?i)url\s*\(`),
|
|
regexp.MustCompile(`(?i)<\?`),
|
|
regexp.MustCompile(`(?i)<%`),
|
|
regexp.MustCompile(`(?i)<!\[CDATA\[`),
|
|
regexp.MustCompile(`(?i)<(svg|animate)`),
|
|
regexp.MustCompile(`(?i)<(audio|video|source)`),
|
|
regexp.MustCompile(`(?i)base64`),
|
|
}
|
|
|
|
func ValidateSafeContent(fl validator.FieldLevel) bool {
|
|
input := strings.ToLower(fl.Field().String())
|
|
for _, pattern := range xssPatterns {
|
|
if pattern.MatchString(input) {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|