Skip to main content

@rtorcato/js-common / security

security

Functions​

stripScriptish()​

stripScriptish(str): string

Defined in: security/index.ts:23

Removes <script> blocks and inline on*= event-handler attributes from a string.

Not a sanitizer, and deliberately not named like one. It is a blocklist over two shapes, so anything it does not name survives, and a single pass can be defeated by nesting the pattern inside itself. Use it as defence in depth on markup you already trust. For untrusted input, escape with html.escapeHtml, or run a real sanitizer such as DOMPurify when the markup must survive.

Example​

stripScriptish('<p onclick="steal()">hi</p><script>bad()</script>')
// '<p>hi</p>'

// Bypassable by construction — this is XSS it does not name, so it survives:
stripScriptish('<a href="javascript:alert(1)">x</a>')
// '<a href="javascript:alert(1)">x</a>'

Parameters​

str​

string

The string to strip.

Returns​

string

The string with script blocks and inline handlers removed.

isStrongPassword()​

isStrongPassword(password): boolean

Defined in: security/index.ts:100

Checks if a password is strong (min 8 chars, upper, lower, number, special char).

Example​

isStrongPassword('Str0ng!pass') // true
isStrongPassword('password') // false
isStrongPassword('Sh0rt!') // false (under 8 characters)

Parameters​

password​

string

The password to check.

Returns​

boolean

True if the password is strong, false otherwise.