Welcome! » Log In » Create A New Profile

Remove XSS, but don't convert to HTML entities

Posted by daGrevis 
daGrevis
Remove XSS, but don't convert to HTML entities
March 09, 2012 10:10AM

Is it possible to configure HTML Purifier so it removes XSS, but doesn't convert characters to HTML entities? I need it for Markdown syntax.

Example:

> Quote

Would be (the same, no XSS):

> Quote

But this (or any other input with XSS in it):

> Quote <script>alert(1)</script>

Would be (input with XSS removed):

> Quote

Is HTML Purifier able to do it? :)

Re: Remove XSS, but don't convert to HTML entities
March 09, 2012 11:20AM

It should do your specific examples already.

daGrevis
Re: Remove XSS, but don't convert to HTML entities
March 09, 2012 11:26AM

Well, no. According to demo page.

> Quote

...becomes:

&gt; Quote
Re: Remove XSS, but don't convert to HTML entities
March 09, 2012 12:43PM

Oh, I see. No, that's not possible. The encoding of all tags is very important for safety. Run Markdown before.

daGrevis
Re: Remove XSS, but don't convert to HTML entities
March 09, 2012 12:50PM

Well, that's shame. I was planning to run Markdown on client-side. :(

Re: Remove XSS, but don't convert to HTML entities
March 09, 2012 12:53PM

Yeah, that's not going to work.

Author:
Your Email:

Subject:

HTML input is enabled. Make sure you escape all HTML and angled brackets with &lt; and &gt;.

Auto-paragraphing is enabled. Double newlines will be converted to paragraphs; for single newlines, use the pre tag.

Allowed tags: a, abbr, acronym, b, blockquote, caption, cite, code, dd, del, dfn, div, dl, dt, em, i, ins, kbd, li, ol, p, pre, s, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, var.

For inputting literal code such as HTML and PHP for display, use CDATA tags to auto-escape your angled brackets, and pre to preserve newlines:

<pre><![CDATA[
Place code here
]]></pre>

Power users, you can hide this notice with:

.htmlpurifier-help {display:none;}

Message: