3 ms·
> DOMPurify’s job is to take an untrusted HTML snippet, supposedly coming from an end-user, and remove all elements and attributes that can lead to Cross-Site S
by rambojazz 6y ago
> DOMPurify’s job is to take an untrusted HTML snippet, supposedly coming from an end-user, and remove all elements and attributes that can lead to Cross-Site Scripting
The error here is to use a blacklist instead of a whitelist.
- amluto 6y agoIf you read the article, you will find that DOMPurify uses a whitelist, that DOMPurify’s model thinks the offending snippet is safe, that nothing in particular is wrong with the model per se, and that the bug is something else entirely.
- bawolff 6y agoI disagree, dompurify takes a blacklist approach of trying to remove evil instead of only allowing through application-specific sane things (that it uses whitelists is a separate thing)
- bugmen0t 6y agoYou need defaults, and that default is an allow-list of sane HTML. If you want, you can initialize DOMPurify with your own allow-list, that might just be the bold, italics, underline, strikethrough. The fact that their list is not namespace-specific is a bigger issue imo.