4 ms·
Agreed. If you discover something is off, just abort early, don't try to save it. One classic exploit I've seen being possible multiple times is when you allow
by matsemann 4y ago
Agreed. If you discover something is off, just abort early, don't try to save it.
One classic exploit I've seen being possible multiple times is when you allow a subset of html and remove other tags. A naive approach will for instance remove <script>. But what happen if I then send in <scr<script>ipt>? If it only does one pass, I fooled it. Instead, just assume the input is done in bad faith when it's encountered and crash, instead of kneading it to something acceptable.
- vore 4y agoThis seems way more error prone than just using an HTML parser and removing script tags. If you use a syntactical parser, you can guarantee your output is safe, all the time. If you're using non-syntactical techniques, then you have to go and find all these edge cases that you should crash on in the first place.
- boxed 4y agoJust for anyone reading this: there is no safe way to de-fang html with a blacklist. You can only safely allow certain tags and attributes. Many people have fallen on this sword.
- orestis 4y agoIn a browser context, the built-in DOMParser (perhaps wrapped in dompurify) is the way to do this. No need to look elsewhere.