@@ -26,30 +26,30 @@ var filterXSSOptions = {
2626 allowCommentTag : true ,
2727 whiteList : whiteList ,
2828 escapeHtml : function ( html ) {
29- // allow html comment in multiple lines
29+ // allow html comment in multiple lines
3030 return html . replace ( / < ( .* ?) > / g, '<$1>' )
3131 } ,
3232 onIgnoreTag : function ( tag , html , options ) {
33- // allow comment tag
33+ // allow comment tag
3434 if ( tag === '!--' ) {
3535 // do not filter its attributes
3636 return html
3737 }
3838 } ,
3939 onTagAttr : function ( tag , name , value , isWhiteAttr ) {
40- // allow href and src that match linkRegex
40+ // allow href and src that match linkRegex
4141 if ( isWhiteAttr && ( name === 'href' || name === 'src' ) && linkRegex . test ( value ) ) {
4242 return name + '="' + filterXSS . escapeAttrValue ( value ) + '"'
4343 }
44- // allow data uri in img src
44+ // allow data uri in img src
4545 if ( isWhiteAttr && ( tag === 'img' && name === 'src' ) && dataUriRegex . test ( value ) ) {
4646 return name + '="' + filterXSS . escapeAttrValue ( value ) + '"'
4747 }
4848 } ,
4949 onIgnoreTagAttr : function ( tag , name , value , isWhiteAttr ) {
50- // allow attr start with 'data-' or in the whiteListAttr
50+ // allow attr start with 'data-' or in the whiteListAttr
5151 if ( name . substr ( 0 , 5 ) === 'data-' || window . whiteListAttr . indexOf ( name ) !== - 1 ) {
52- // escape its value using built-in escapeAttrValue function
52+ // escape its value using built-in escapeAttrValue function
5353 return name + '="' + filterXSS . escapeAttrValue ( value ) + '"'
5454 }
5555 }
0 commit comments