3 ms·

This is important reading: http://www.feedparser.org/docs/html-sanitization.html http://www.feedparser.org/docs/html-sanitization.html I'm not convinced it's

This is important reading: http://www.feedparser.org/docs/html-sanitization.html http://www.feedparser.org/docs/html-sanitization.html I'm not convinced it's possible to stop a browser executing code, because there are so many possible ways a browser can be given code to execute. Not only do you have to read all the specs for all the versions of the browsers, you've got to find all the bugs in them too. Case in point: An earlier version of this code didn't remove javascript from CSS expressions, making it possible to get past it in IE6 and 7. I gave up trying to sanitize HTML, and instead used a library to render it to plain text and stuck it in a <pre> element with usual HTML escaping. But I need to take a very paranoid approach in my app. EDIT to add: I think this is probably one of the better java implementation, and has a good whitelisting approach to HTML. However, it's let down by taking a blacklist approach to CSS.

niyazpk 17y ago
If you are doing HTML sanitization, white-listing is the way to go (both HTML and CSS). Another thing to note is that if you are trying to get away with sanitization by some regex magic, you are destined to fail. In many cases, you don't have to use HTML at all. Use something like MarkDown and it will save you a lot of time and frustration. http://daringfireball.net/projects/markdown/ http://daringfireball.net/projects/markdown/
- bensummers 17y ago
  My app gets people uploading test data which is provided formatted in HTML, so I don't have the luxury of requiring a different markup language. But you're right, using HTML is very often overkill.
- TomasSedovic 17y ago
  Unfortunatelly MarkDown both allows HTML and uses regex magic :-).
robicch 17y ago
Yes, true, a 100% safe sanitizer is a dream at least for older browsers versions. Of course you can choose a different approach using a different markup language. My approach to this problem is to preserve as much html you can. The older version was laking of a css black list that has been addded. By default this sanitize encode unknown chars, and is easy to add white or black elements

niyazpk 17y ago

If you are doing HTML sanitization, white-listing is the way to go (both HTML and CSS). Another thing to note is that if you are trying to get away with sanitization by some regex magic, you are destined to fail. In many cases, you don't have to use HTML at all. Use something like MarkDown and it will save you a lot of time and frustration. http://daringfireball.net/projects/markdown/ http://daringfireball.net/projects/markdown/

bensummers 17y ago
My app gets people uploading test data which is provided formatted in HTML, so I don't have the luxury of requiring a different markup language. But you're right, using HTML is very often overkill.
TomasSedovic 17y ago
Unfortunatelly MarkDown both allows HTML and uses regex magic :-).

robicch 17y ago

Yes, true, a 100% safe sanitizer is a dream at least for older browsers versions. Of course you can choose a different approach using a different markup language. My approach to this problem is to preserve as much html you can. The older version was laking of a css black list that has been addded. By default this sanitize encode unknown chars, and is easy to add white or black elements