4 ms·
Even whitelisting is dangerous for web/html. Given any tag, there's probably a large number of things you can do with them that boggles the mind as in "whoa I d
by barkingcat 9y ago
Even whitelisting is dangerous for web/html. Given any tag, there's probably a large number of things you can do with them that boggles the mind as in "whoa I didn't know you could do that..." including things that are not in the w3c specs but are coded into the interpreters.
Basically the experience of a web developer every day, no matter how experienced you are.
- scotty79 9y agoI you whitelist tags and then whitelist attributes and then whitelist attribute values and for attributes that have values with its own structure, like style whitelist allowed things in that structure, you should be fine. But it's hard to restrain yourself from doing: allow any (possibly except some) at any stage of whitelisting. Even to a point of not allowing string of any characters as attribute value.