5 ms·
Then it needs to be better aware of what kind of syntax is allowed in CSS, because </math> clearly isn't valid CSS. Sanitizing HTML isn't just about removing u
by kijin 6y ago
Then it needs to be better aware of what kind of syntax is allowed in CSS, because </math> clearly isn't valid CSS.
Sanitizing HTML isn't just about removing unwanted tags and attributes. Assuming you want to preserve some styling, the sanitizer needs to be aware of the spec for not only HTML but also CSS, JS, SVG, and whatnot. It must ensure that it never emits output that would be invalid in any of those contexts. (JS is easy because you normally just delete it.)
To date, I haven't seen any HTML sanitizer that's as serious about enforcing spec as HTMLPurifier. It strips out everything that isn't in a whitelist and guarantees that the output is syntactically valid. Unfortunately, it's written in PHP, its whitelist is kinda outdated, and nobody seems to want to port it to any other language. But the only alternative is to take dangerous shortcuts.
- missblit 6y agoNot sure strict CSS parsing would have avoided this issue, since you could just surround what the purifier thought was a style text node with /* and */ (which is valid CSS, being a comment)
- securitymb 6y agoEven if comments were stripped (which sometimes happens), you could still put it in the URL or font family name: * { font-family: '</math>...'; }
- kijin 6y agoSanitizers are not required to keep the original content intact. They absolutely can, and should, strip invalid and/or suspicious content from CSS strings.