Skip to main content

@rtorcato/js-common / security

security

Functions​

stripScriptish()​

stripScriptish(str): string

Defined in: security/index.ts:25

Removes <script> blocks and inline on*= event-handler attributes from a string.

Not a sanitizer, and deliberately not named like one. It is a blocklist over two shapes, so anything it does not name survives, and a single pass can be defeated by nesting the pattern inside itself. Use it as defence in depth on markup you already trust. For untrusted input, escape with html.escapeHtml, or run a real sanitizer such as DOMPurify when the markup must survive.

Example​

stripScriptish('<p onclick="steal()">hi</p><script>bad()</script>')
// '<p>hi</p>'

// Bypassable by construction — this is XSS it does not name, so it survives:
stripScriptish('<a href="javascript:alert(1)">x</a>')
// '<a href="javascript:alert(1)">x</a>'

Parameters​

str​

string

The string to strip.

Returns​

string

The string with script blocks and inline handlers removed.

isStrongPassword()​

isStrongPassword(password): boolean

Defined in: security/index.ts:102

Checks if a password is strong (min 8 chars, upper, lower, number, special char).

Example​

isStrongPassword('Str0ng!pass') // true
isStrongPassword('password') // false
isStrongPassword('Sh0rt!') // false (under 8 characters)

Parameters​

password​

string

The password to check.

Returns​

boolean

True if the password is strong, false otherwise.

generateSecureToken()​

generateSecureToken(length?): string

Defined in: security/index.ts:120

Generates a cryptographically secure random token (hex string).

Example​

generateSecureToken() // 64 hex chars (32 bytes)
generateSecureToken(8) // 'c1f0a4e29b73d518'

Parameters​

length?​

number = 32

The number of bytes (not hex chars).

Returns​

string

A random hex string.