Remove scripts from html string using regex

Question

I want to remove <script> tags from an html string using regex.

I have the following code which works, but doesn't work when you put back to back scripts:

function removeScriptsFromHtmlStr(html) {
  const regex = /<script(?:(?!\/\/)(?!\/\*)[^'"]|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.(?:\n)|\/\*(?:(?:.|\s))*?\*\/)*?<\/script>/;
  const result = html.replace(regex, '');
  return result;
}

So for example:

running this through the funciton will work fine

<script>alert(document.cookie);</script>

but this won't:

<script>alert(document.cookie);</script><script>alert(document.cookie);</script>

How can I update the regex to fix this?

add a g flag (stands for global). So /your regex/g, otherwise only the first match will be replaced — Robbie Milejczak
– Robbie Milejczak, Commented Feb 18, 2020 at 19:36
Does this answer your question? Removing all script tags from html with JS Regular Expression — Rapsssito
– Rapsssito, Commented Feb 18, 2020 at 19:36
If this is done for security reasons, then don't do it with RegExp, it's far too easy to trick any RegExp you ever can create. Create a DocumentFragment instead, attach the HTML, and remove the script elements from the parsed fragment. — Teemu
– Teemu, Commented Feb 18, 2020 at 19:43
Don't parse HTML with regex. RegEx match open tags except XHTML self-contained tags — CAustin
– CAustin, Commented Feb 18, 2020 at 19:45

MonkeyZeus · Accepted Answer · 2020-02-18 20:13:27Z

0

Since JavaScript does not support the Singleline /s flag you will need to do a workaround for .:

/<script.*?>[\s\S]*?<\/script>/gi

https://regex101.com/r/7iFLnA/1

edited Feb 18, 2020 at 20:13

answered Feb 18, 2020 at 20:01

MonkeyZeus

20.8k4 gold badges41 silver badges83 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Stanton · Accepted Answer · 2020-02-18 19:40:20Z

-1

Lazy loading should do the trick <script>(.+?)<\/script>

answered Feb 18, 2020 at 19:40

Stanton

32 bronze badges

Comments

Bilal Amin · Accepted Answer · 2020-02-18 19:53:11Z

-1

try this regex

/<script.*?>.*?<\/script>/igm

https://stackoverflow.com/a/15816902/5812095

answered Feb 18, 2020 at 19:53

Bilal Amin

11 silver badge3 bronze badges

Collectives™ on Stack Overflow

Remove scripts from html string using regex

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related