Removing all script tags from html with JS Regular Expression – Even if we have a good project plan and a logical concept, we will spend the majority of our time correcting errors abaout and . Furthermore, our application can run without obvious errors with JavaScript, we must use various ways to ensure that everything is operating properly. In general, there are two types of errors that you’ll encounter while doing something wrong in code: Syntax Errors and Logic Errors. To make bug fixing easier, every JavaScript error is captured with a full stack trace and the specific line of source code marked. To assist you in resolving the JavaScript error, look at the discuss below to fix problem about Removing all script tags from html with JS Regular Expression.
Problem :
I want to strip script tags out of this HTML at Pastebin:
I tried using the below regular expression:
html.replace(/<script.*>.*</script>/ims, " ")
But it does not remove all of the script tags in the HTML. It only removes in-line scripts. I’m looking for some regex that can remove all of the script tags (in-line and multi-line). It would be highly appreciated if a test is carried out on my sample http://pastebin.com/mdxygM0a
Solution :
jQuery uses a regex to remove script tags in some cases and I’m pretty sure its devs had a damn good reason to do so. Probably some browser does execute scripts when inserting them using innerHTML.
Here’s the regex:
/<scriptb[^<]*(?:(?!</script>)<[^<]*)*</script>/gi
And before people start crying “but regexes for HTML are evil”: Yes, they are – but for script tags they are safe because of the special behaviour – a <script> section may not contain </script> at all unless it should end at this position. So matching it with a regex is easily possible. However, from a quick look the regex above does not account for trailing whitespace inside the closing tag so you’d have to test if </script etc. will still work.
Attempting to remove HTML markup using a regular expression is problematic. You don’t know what’s in there as script or attribute values. One way is to insert it as the innerHTML of a div, remove any script elements and return the innerHTML, e.g.
function stripScripts(s) {
var div = document.createElement('div');
div.innerHTML = s;
var scripts = div.getElementsByTagName('script');
var i = scripts.length;
while (i--) {
scripts[i].parentNode.removeChild(scripts[i]);
}
return div.innerHTML;
}
alert(
stripScripts('<span><script type="text/javascript">alert('foo');</script></span>')
);
Note that at present, browsers will not execute the script if inserted using the innerHTML property, and likely never will especially as the element is not added to the document.
Regexes are beatable, but if you have a string version of HTML that you don’t want to inject into a DOM, they may be the best approach. You may want to put it in a loop to handle something like:
<scr<script>Ha!</script>ipt> alert(document.cookie);</script>
Here’s what I did, using the jquery regex from above:
var SCRIPT_REGEX = /<scriptb[^<]*(?:(?!</script>)<[^<]*)*</script>/gi;
while (SCRIPT_REGEX.test(text)) {
text = text.replace(SCRIPT_REGEX, "");
}
This Regex should work too:
<script(?:(?!//)(?!/*)[^'"]|"(?:\.|[^"\])*"|'(?:\.|[^'\])*'|//.*(?:n)|/*(?:(?:.|s))*?*/)*?</script>
It even allows to have “problematic” variable strings like these inside:
<script type="text/javascript">
var test1 = "</script>";
var test2 = ''</script>';
var test1 = ""<
/script>