SChandan516395 (Community Member) asked a question.
How to escape only XSS Evil Javascript strings and not the entire html?
Hi ,
I'm displaying an HTML string on browser , the string is built in the backend aspx vb code
I'm looking for an Library which only Encodes ort Escapes javascript entities and not the rest
For eg
if the string is "hello <script> evilscript()</script> <b>sandeep</b>"
I still want to retain "<b>" element from the HTML string so the final string should be "hello <b>sandeep</b>"
Please assist
.png){kind=logo}
Hi,
Making a given HTML 'safe' is typically called "HTML sanitization" ( https://en.wikipedia.org/wiki/HTML_sanitization ). It is also notoriously difficult to do safely.
I would strongly urge you to consider if it is not possible to apply HTML encoding / escaping instead as this is much safer.
If you must perform sanitization, Veracode Static Analysis supports only a few sanitizers, for example:
" antixsslibrary_dll.Microsoft.Security.Application.AntiXss.GetSafeHtmlFragment ". You can find the full list of supported cleansing functions here: https://docs.veracode.com/r/review_cleansers
Thank you,
Boy Baukema
Thanks Boy , Tried the AntiXss Library . works great . Thanks for suggesting
There is one small problem - some times my HTML content has an Hyperlink with javascrpt method call
eg : "hello click <a href='javascript:somemethod()'>here</a>"
if i call sanitizer method , it rips off the js method to "<a href=''>here</a>""
how should I handle this ?
I realized the above use case can only be handled by specifically setting the sanitization method only for the specific attributes
If the HTML is eg : "hello click <a href='javascript:somemethod()'>{CLIENT_DATA}</a>" , then the sanitization needs to be run on {CLIENT_DATA}