// scrubber.js
//
// Scrub HTML for dangerous XSS crap
//
// Copyright 2012, E14N https://e14n.com/
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

var _ = require("underscore"),
    validator = require("validator"),
    sanitize = validator.sanitize,
    sanitizeHtml = require("sanitize-html");

var Scrubber = {
    scrub: function(str) {
        // using defaults
        // { allowedTags: ['b', 'i', 'em', 'strong', 'a'], allowedAttributes: { a: ['href']}}
        return sanitizeHtml(str);
    },
    scrubActivity: function(act) {

        var strings = ["content"],
            objects = ["actor",
                       "object",
                       "target",
                       "generator",
                       "provider",
                       "context",
                       "source"],
            arrays = ["to",
                      "cc",
                      "bto",
                      "bcc"];

        // Remove any incoming private properties

        _.each(act, function(value, key) {
            if (key[0] == "_") {
                delete act[key];
            }
        });

        _.each(strings, function(sprop) {
            if (_.has(act, sprop)) {
                act[sprop] = Scrubber.scrub(act[sprop]);
            }
        });

        _.each(objects, function(prop) {
            if (_.has(act, prop)) {
                if (_.isObject(act[prop])) {
                    act[prop] = Scrubber.scrubObject(act[prop]);
                }
            }
        });

        _.each(arrays, function(array) {
            if (_.has(act, array)) {
                if (_.isArray(act[array])) {
                    _.each(act[array], function(item, index) {
                        Scrubber.scrubObject(item);
                    });
                }
            }
        });

        return act;
    },
    scrubObject: function(obj) {

        var strings = ["content", "summary"],
            objects = ["author",
                       "location"],
            arrays = ["attachments",
                      "tags"];

        // Remove any incoming private properties

        _.each(obj, function(value, key) {
            if (key[0] == "_") {
                delete obj[key];
            }
        });

        _.each(strings, function(sprop) {
            if (_.has(obj, sprop)) {
                obj[sprop] = Scrubber.scrub(obj[sprop]);
            }
        });

        _.each(objects, function(prop) {
            if (_.has(obj, prop)) {
                if (_.isObject(obj[prop])) {
                    obj[prop] = Scrubber.scrubObject(obj[prop]);
                }
            }
        });

        _.each(arrays, function(array) {
            if (_.has(obj, array)) {
                if (_.isArray(obj[array])) {
                    _.each(obj[array], function(item, index) {
                        Scrubber.scrubObject(item);
                    });
                }
            }
        });

        return obj;
    }
};

// So you can require("scrubber").Scrubber or just require("scrubber")

Scrubber.Scrubber = Scrubber;

module.exports = Scrubber;

@@ -725,43 +725,8 @@
 %22),%0A
-    sanitize = validator.sanitize,%0A
     
@@ -823,25 +823,34 @@
     
-// using defaults
+return sanitizeHtml(str, %7B
 %0A   
@@ -858,12 +858,11 @@
     
-// %7B
+   
  all
@@ -875,40 +875,70 @@
 gs: 
-%5B'b', 'i', 'em', 'strong', 'a'%5D,
+sanitizeHtml.defaults.allowedTags.concat(%5B%22img%22%5D),%0A           
  all
@@ -958,54 +958,287 @@
 s: %7B
+%0A               
  a: %5B
-'
+%22
 href
-'%5D%7D%7D%0A        return sanitizeHtml(str
+%22, %22name%22, %22target%22%5D,%0A                img: %5B%22src%22%5D,%0A                %22*%22: %5B%22data-*%22%5D%0A            %7D,%0A            allowedSchemes: %5B%22http%22, %22https%22, %22ftp%22, %22mailto%22, %22xmpp%22, %22irc%22%5D,%0A            allowedSchemesByTag: %5B%22http%22, %22https%22, %22ftp%22, %22data%22%5D%0A        %7D
 );%0A 

Allow more HTML things through the scrubber