Kevin Lam's Web Log

Hello Kevin,

I read your article about this and learned some troubling things I didn't know, like SRC being dangerous.

I have read elsewhere that even CSS is dangerous! This really bothers me.

We need to be able to allow our users to specify HTML content, but we definitely want to purify it. We've found numerous possible solutions coded in PHP or Perl, but no utility for C# thus far.

We have searched in vain for finding a robust solution to this. But, the algorithm I have come up with is like this. Does this sound accurate to you?

·   Define a White List of allowed HTML tags

·   Define a Black List of explicitly denied HTML tags whose contents should also be removed, like SCRIPT and OBJECT (as browsers introduce new tags, however, this will have to be updated)

·   Define a Black List of attributes that _must_ be removed from tags, such as any attribute starting with “on”, like onmouseover, onclick, etc. Also, “data*”

·   Define a list of White List protocol handlers, like "http", "https", “ftp”, “mailto”, etc.

·   Define a scan list of attributes that can contain executable protocol handlers, like "action", "background", "codebase", "dynsrc", "href", "lowsrc", "src"

·   Load incoming HTML input into an html parser

·   Pass over input and copy only the tags from the White List, but also:

o  Explicitly remove the Black Listed tags and their children content

o  Remove Black Listed attributes

o  Remove attributes of scan list that start with protocol handlers not specified in the white list of protocol handlers

§   This would remove attributes that start with “javascript:” or “about:”. There is

o  Remove dangerous CSS rules, like behavior:, expression:, or javascript: or “java     script”, etc

Note that in this approach, code like “<marquee>testing<b>bold</b></marquee>” would be filtered to be “testing<b>bold</b>”. But, all “<script>” and “<object>” tags would be completely removed as would their child content.

Thanks!

Josh