Scripts - XSS Attack Prevention

[MaheshkumarSundaram]

Hi @ralphhanna,

As the project has become stable, I thought it would be a significant security feature to include sanitizing the JS code to prevent XSS attacks.
What do you think?

[ralphhanna]

Sure, what do you have in mind?

[MaheshkumarSundaram]

@ralphhanna,

Probably a combination of the below:

• We could use RegEx to filter out patterns or calls like eval() or Function()
• We could use some tool like acorn to parse and validate the code
• Whitelist/Blacklist approach to restrict and allow functionalities

But I am not sure how feasible this would be?