inject = require("./inject") security = require("./security") headRe = /()/i bodyRe = /()/i htmlRe = /()/i rewriteHtml = (html, domainName, wantsInjection, wantsSecurityRemoved) -> replace = (re, str) -> html.replace(re, str) htmlToInject = do => switch wantsInjection when "full" inject.full(domainName) when "partial" inject.partial(domainName) ## strip clickjacking and framebusting ## from the HTML if we've been told to if wantsSecurityRemoved html = security.strip(html) switch when headRe.test(html) replace(headRe, "$1 #{htmlToInject}") when bodyRe.test(html) replace(bodyRe, " #{htmlToInject} $1") when htmlRe.test(html) replace(htmlRe, "$1 #{htmlToInject} ") else " #{htmlToInject} " + html module.exports = { html: rewriteHtml security: security.stripStream }