> You really shouldn't do "block this element, allow this element" type sanitizing ever. > What you should do is: > 1. Parse the input into an AST that only a

> You really shouldn't do "block this element, allow this element" type sanitizing ever. > What you should do is: > 1. Parse the input into an AST that only allows safe nodes. I.e. the AST should have no <script> node at all. 2. Write it back out as HTML. Firstly I don't see the difference between what you say you shouldn't do and what you say you should do. This is what a sanitizer does: it parses the input into an AST that only allows safe things. It does "block this element, allow this element" on an AST. So I don't understand what things you're contrasting? Secondly, I guess this was just brevity, but disallowing script nodes is the tip of the iceberg when it comes to sanitization. You need to deal with a plethora of vectors involving scriptable & interactivity attributes, and other "active" non-script elements.