3 ms·
Any decent WYSIWYG editor (which I assume your data is coming from if you're trying to sanitize arbitrary HTML) will render "<span>" as "&lt;span&gt;" i
by kijin 6y ago
Any decent WYSIWYG editor (which I assume your data is coming from if you're trying to sanitize arbitrary HTML) will render "<span>" as "&lt;span&gt;" in the first place. The sanitizer doesn't need to do anything to it, as the markup is already valid.
- thaumasiotes 6y agoYou've managed to miss the whole point of the discussion thread and the article above it. Your data is coming from a user. You need to change "<img src onerror=alert(1)>" to "<img src onerror=alert(1)>". You will not be able to do this if your approach is "doesn't matter; we'll just trust whatever we get".