kennygrant / sanitize Goto Github PK

<span style="color:#999;font-size:8px;">
        <script type="text/javascript">
            //something
        </script>
</span>

how to remove all of <script>...</script>?

Path function is dealing correctly with this vector "http://localhost:8080/?file=..\etc/passwd" but when you use "http://localhost:8080/?file=../etc/passwd" the result path will be "/etc/passwd"

Is it correct that when using sanitize.HTML the HTML like <p>1 < 2</p> won't be parsed accurately?

This has the makings of a great sanitization library but right now it appears to have some vulnerabilities, based on a quick read-through of the clear and well-written code.

https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md

To quote the first cheatsheet: Even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the escape syntax for the part of the HTML document you're putting untrusted data into.

It might be useful to develop a test suite based on this:
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

For example, escaping only <> isn't enough. OWASP used to have a list (as follows), but now even this isn't sufficient.

&  -> &
< -> &lt;
> -> &gt;
" -> &quot;
' -> &#x27;
/ -> &#x2F;
\n ->  <br>

Also have a look at how https://github.com/microcosm-cc/bluemonday does it.

This is another OWASP cheat sheet that might be valuable:

https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Input_Validation_Cheat_Sheet.md

Go code:

package main

import (
    "fmt"

    "github.com/kennygrant/sanitize"
)

func main() {
    content := `<p>LINE 1<br />
LINE 2<br />
LINE 3</p>`
    fmt.Println(sanitize.HTML(content))
}

Will provide:

LINE 1LINE 2LINE 3

New lines are missing. I can fix this by myself, but want to be sure if you'll merge my PR as latest commit is 1 year old.

A couple of defaults I'd like to be able to override:

• lower case strings: I'd like to preserve mixed case
• use of - separator: I'd like to use _