It is possible to fool strip-tags
Open
- Dominant language
- JavaScript
- Stars
- 2.9k
- Forks
- 319
- PR merge metrics
- No merged PRs in 30d
Description
`'ipt> alert(document.cookie);ipt>'` turns into ` alert(document.cookie);`.
The simpler regexp `/<[^>]+>/g` does strip the HTML.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.