YWang726146 (Community Member) asked a question.
CWE 80 Why HtmlSanitizer is not one of the cleanser functions recognized by Veracode?
Hi,
Originate from this post, I'm wondering why HtmlSanitizer is not one of the cleanser functions recognized by Veracode?
For the recognized sanitizer functions:
Microsoft.Security.Application.AntiXss seems discontinued for long and hasn't been updated since Jan 2012
Microsoft.Security.Application.Sanitizer.GetSafeHtml seems not updated since 2014.
See this post and this post and this post.
Should we still choose AntiXss over HtmlSanitizer ?
https://docs.veracode.com/r/Supported_NET_Cleansing_Functions
Thanks in advance!
.png){kind=logo}
Hi @YWang726146 (Community Member) ,
Veracode Research determines the supported cleansing functions. One of the things they evaluate during this is possible False Negative rate. Specifically, can this be used incorrectly to 'fix' something.
This means that typically HTML sanitization functions are not acceptable as they (like https://github.com/mganss/HtmlSanitizer ) are typically very configurable and it's possible to configure them incorrectly.
Microsofts 'GetSafeHtml' and 'GetSafeHtmlFragment' were rare exceptions that were very strict and did not accept configuration as such they were added at the time.
This does not mean that HtmlSanitizer is not perfectly acceptable or that we recommend using AntiXSS for modern applications.
HTML `santization` in general is very difficult to do both securely and effectively as a purely technical control (using a library like https://github.com/mganss/HtmlSanitizer ) and is best implemented with manual verification controls in place (like a review process that requires a different reviewer for updates).
Whenever possible it's best to not use sanitization, but if you must use sanitization you should document what controls you have in place in a mitigation proposal. You can learn more about mitigation proposals here: https://community.veracode.com/s/knowledgeitem/mitigations-part-1-what-is-a-mitigation-MCKTIDIWZQ3RBENLRUYP4KSZW3SQ .
Thank you,
Boy Baukema