HTML sanitization: Difference between revisions

Revision as of 07:28, 23 December 2017

Revision as of 12:58, 23 December 2017

Line 1:

{{Refimprove|date=December 2009}}

'''HTML sanitization ''' is the process of examining an HTML document and producing a new HTML document that preserves only whatever tags are designated "safe" and desired. HTML sanitization can be used to protect against [[cross-site scripting|cross-site scripting (XSS)]] attacks by sanitizing any HTML code submitted by a user.

Basic tags for changing fonts are often allowed, such as <code>&lt;b&gt;</code>, <code>&lt;i&gt;</code>, <code>&lt;u&gt;</code>, <code>&lt;em&gt;</code>, and <code>&lt;strong&gt;</code> while more advanced tags such as <code>&lt;script&gt;</code>, <code>&lt;object&gt;</code>, <code>&lt;embed&gt;</code>, and <code>&lt;link&gt;</code> are removed by the sanitization process. Also potentially dangerous attributes such as the < code>onclick</code> attribute are removed in order to prevent malicious code from being injected.

Sanitization is typically performed by using either a [[whitelist]] or a [[Blacklist (computing)|blacklist]] approach. Leaving a safe HTML element off a whitelist is not so serious; it simply means that that feature will not be included post-sanitation. On the other hand, if an unsafe element is left off a blacklist, then the vulnerability will not be sanitized out of the HTML output. An out-of-date blacklist can therefore be dangerous if new, unsafe features have been introduced to the HTML Standard.