Javascript sanitization: The most safe way to insert possible XSS html string

Question

Currently i'm using this method with jQuery solution, to clean string from possible XSS attacks.

sanitize:function(str) { // return htmlentities(str,'ENT_QUOTES'); return $('<div></div>').text(str).html().replace(/"/gi,'&quot;').replace(/'/gi,'&apos;'); }

But i have a feeling it's not safe enough. Do i miss something?

I have tried htmlentities from phpjs project here: http://phpjs.org/functions/htmlentities:425/

But it's kinda bugged and returns some additional special symbols. Maybe it's an old version?

For example:

htmlentities('test"','ENT_QUOTES');

Produces:

test&amp;quot;

But should be:

test&quot;

How are you handling this via javascript?

Insert into html document ofc as text. As href="sanitized" or src="sanitized", or <div>sanitized</div> — Somebody
– Somebody, Commented Jul 2, 2012 at 10:57
From where the insert is triggered? Do you want to insert the string into an already opened page dynamically using Javascript, or into the server-generated HTML document using PHP? — penartur
– penartur, Commented Jul 2, 2012 at 10:59
Yes dynamically using javascript. String comes from untrusted source. — Somebody
– Somebody, Commented Jul 2, 2012 at 11:06
Use Caja's html_sanitize.js. stackoverflow.com/questions/12253686/… — Mike Stay
– Mike Stay, Commented Sep 4, 2012 at 23:47

Oleg V. Volkov · Accepted Answer · 2012-07-02 11:07:55Z

3

If your string is supposed to be plain text without HTML formatting, just use .createTextNode(text)/assigning to .data property of existing text node. Whatever you put there will always be interpreted as text and needs no additional escaping.

answered Jul 2, 2012 at 11:07

Oleg V. Volkov

22.6k4 gold badges49 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Somebody Over a year ago

What about ' or " and others symbols of which i maybe don't know?

Oleg V. Volkov Over a year ago

I wrote "whatever" and it is "whatever" indeed. You'd be manipulating field in DOM structure that can hold only text. Those operations won't ever cause any automagical invocations of HTML parser like famous innerHTML would do (this, BTW, is still considered one of the worst design flaws of that feature).

penartur · Accepted Answer · 2012-07-02 11:14:08Z

3

Yes dynamically using javascript. String comes from untrusted source.

Then you don't need to sanitize it manually. With jQuery you can just write

var str = '<div>abc"def"ghi</div>'; $('test').text(str); $('test').attr('alt', str);

Browser will separate the data from the code for you.

Example: http://jsfiddle.net/HNQvd/

answered Jul 2, 2012 at 11:14

penartur

9,9325 gold badges41 silver badges51 bronze badges

4 Comments

Oleg V. Volkov Over a year ago

While alt is safe, you will still have problems with attributes that can be interpreted as non-text down the line. Most obviously onclick and other handlers, but also src.

penartur Over a year ago

Everything could be considered harmful. If the OP is going to change arbitrary attributes (with user-supplied names), then they have much bigger problem than just sanitizing the values.

Somebody Over a year ago

People. I have a working solution in my post. I just want you people, to updated it if it have some vulnerabilities if used inside <div>HERE</div> or <a href="HERE"></a> , or <img src="HERE"/>. That's all. :)

penartur Over a year ago

@Beck Once again, you should not re-invent the bicycle (which may have some vulnerabilities); you should rather use a well-supported standard solution which separates the data and the code. For example, instead of trying hard to sanitize the string and then writing your sort-of-sanitized result into the innerHtml, you should rather leave the source string as-is and write it into the innerText.

some_coder · Accepted Answer · 2021-04-26 14:18:32Z

1

You should quote other characters too:

' " < > ( ) ;

They all can be used for XSS attacks.

edited Apr 26, 2021 at 14:18

answered Jul 2, 2012 at 11:11

some_coder

3401 gold badge7 silver badges15 bronze badges

Collectives™ on Stack Overflow

Javascript sanitization: The most safe way to insert possible XSS html string

3 Answers 3

2 Comments

4 Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

4 Comments

Comments

Linked

Related