Index: misc/drupal.js
===================================================================
RCS file: /cvs/drupal/drupal/misc/drupal.js,v
retrieving revision 1.49
diff -u -p -r1.49 drupal.js
--- misc/drupal.js	6 Jan 2009 13:16:09 -0000	1.49
+++ misc/drupal.js	29 Jan 2009 23:14:03 -0000
@@ -92,6 +92,27 @@ Drupal.checkPlain = function(str) {
 };
 
 /**
+ * Filters XSS.
+ */
+Drupal.filterXSS = function(str, allowed_tags) {
+  var output = "";
+  $.ajax({
+    url: Drupal.settings.basePath + 'system/filter-xss',
+    data: {
+      'string' : str,
+      'allowed_tags' : allowed_tags,
+    },
+    type: "POST",
+    async: false,
+    dataType:  "json",
+    success: function(data) {
+      output = data;
+    }
+  });
+  return output;
+};
+
+/**
  * Translate strings to the page language or a given language.
  *
  * See the documentation of the server-side t() function for further details.
Index: modules/system/system.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.module,v
retrieving revision 1.662
diff -u -p -r1.662 system.module
--- modules/system/system.module	28 Jan 2009 07:43:26 -0000	1.662
+++ modules/system/system.module	29 Jan 2009 23:14:05 -0000
@@ -414,6 +414,12 @@ function system_menu() {
     'access callback' => TRUE,
     'type' => MENU_CALLBACK,
   );
+  $items['system/filter-xss'] = array(
+    'title' => 'Filter XSS',
+    'page callback' => 'system_filter_xss',
+    'access callback' => TRUE,
+    'type' => MENU_CALLBACK,
+  );
   $items['admin'] = array(
     'title' => 'Administer',
     'access arguments' => array('access administration pages'),
@@ -2273,3 +2279,18 @@ function theme_meta_generator_header($ve
 function system_image_toolkits() {
   return array('gd');
 }
+
+/**
+ * Menu callback; Retrieve a JSON object containing the filtered XSS string.
+ */
+function system_filter_xss() {
+  if (!empty($_POST['allowed_tags'])) {
+    $allowed_tags = explode(',', $_POST['allowed_tags']);
+    $output = filter_xss($_POST['string'], $allowed_tags);
+  }
+  else {
+    $output = filter_xss($_POST['string']);
+  }
+  drupal_json($output);
+}
+