From 70262bcb3e9d8b990d6f8b1d783ce66158cea760 Mon Sep 17 00:00:00 2001
From: Evan Hahn <me@evanhahn.com>
Date: Sat, 2 Apr 2016 14:37:55 -0700
Subject: [PATCH] Improve Helmet's xssFilter options

Made two improvements here:

1. `xssFilter` takes an object with a certain interface, not just any
   `Object`.
2. Changed the `@summary` documentation.
---
 helmet/helmet-tests.ts |  2 ++
 helmet/helmet.d.ts     | 10 +++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/helmet/helmet-tests.ts b/helmet/helmet-tests.ts
index 83fd224a7..065d9bfa2 100644
--- a/helmet/helmet-tests.ts
+++ b/helmet/helmet-tests.ts
@@ -17,6 +17,8 @@ function helmetTest() {
  */
 function xssFilterTest() {
     app.use(helmet.xssFilter());
+    app.use(helmet.xssFilter({}));
+    app.use(helmet.xssFilter({ setOnOldIE: false }));
     app.use(helmet.xssFilter({ setOnOldIE: true }));
 }
 
diff --git a/helmet/helmet.d.ts b/helmet/helmet.d.ts
index 39f831155..9e571ad24 100644
--- a/helmet/helmet.d.ts
+++ b/helmet/helmet.d.ts
@@ -24,7 +24,11 @@ declare module "helmet" {
         disableAndroid? : boolean;
         directives? : IHelmetCspDirectives
     }
-    
+
+    interface IHelmetXssFilterConfiguration {
+        setOnOldIE? : boolean;
+    }
+
     /**
      * @summary Interface for helmet class.
      * @interface
@@ -82,11 +86,11 @@ declare module "helmet" {
         publicKeyPins(options ?: Object):express.RequestHandler;
 
         /**
-         * @summary Prevent Cross-site scripting attacks.
+         * @summary Mitigate cross-site scripting attacks with the "X-XSS-Protection" header.
          * @return {RequestHandler} The Request handler.
          * @param {Object} options The options.
          */
-        xssFilter(options ?: Object):express.RequestHandler;
+        xssFilter(options ?: IHelmetXssFilterConfiguration):express.RequestHandler;
 
         /**
          * @summary Set policy around third-party content via headers