4 ms·
>> "show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>)." 1. Disallow everything. Esc
by axod 16y ago
>> "show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>)."
1. Disallow everything. Escape everything 100%.
2. Now selectively parse out the original and recreate what is explicitly allowed. Do not include anything from the input in the code portions of the output that hasn't been completely sanitized.
This isn't a hard problem. It's like asking "Make a firewall that allows mysql through and ssh, but nothing else". The thing is, people make mistakes, and developers are often lazy.
>> "Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS."
Asking the browser to do your security for you seems pretty lazy. If you can't manage to escape HTML properly, what other security issues are there likely to be that the browser can't help with? SQL injections?
- raganwald 16y ago> selectively parse out the original and recreate what is explicitly allowed. This is the ONLY solution. trying to blacklist and escape characters is ultimately trying to push your parsing problem down to the browser, and what will you do when the browser contains a bug that someone can exploit to steal your own credentials on the web app? I'm a strong believer in using JS to inject unsafe text directly into the DOM. If you want people to mark stuff up, give them a markup language that you parse. Note that Markdown has its issues: If you use a library to parse it, be aware that html is valid markdown, so you're just moving the HTML escape problem around.