HTML sanitization
{{Short description|Process of removing undesirable parts of an HTML document}}
{{More citations needed|date=December 2009}}
In data sanitization, HTML sanitization is the process of examining an HTML document and producing a new HTML document that preserves only whatever tags and attributes are designated "safe" and desired. HTML sanitization can be used to protect against attacks such as cross-site scripting (XSS) by sanitizing any HTML code submitted by a user.
Details
Basic tags for changing fonts are often allowed, such as <b>, <i>, <u>, <em>, and <strong> while more advanced tags such as <script>, <object>, <embed>, and <link> are removed by the sanitization process. Also potentially dangerous attributes such as the onclick attribute are removed in order to prevent malicious code from being injected.
Sanitization is typically performed by using either a whitelist or a blacklist approach. Leaving a safe HTML element off a whitelist is not so serious; it simply means that that feature will not be included post-sanitation. On the other hand, if an unsafe element is left off a blacklist, then the vulnerability will not be sanitized out of the HTML output. An out-of-date blacklist can therefore be dangerous if new, unsafe features have been introduced to the HTML Standard.
Further sanitization can be performed based on rules which specify what operation is to be performed on the subject tags. Typical operations include removal of the tag itself while preserving the content, preserving only the textual content of a tag or forcing certain values on attributes.{{Cite web|url=https://github.com/Vereyon/HtmlRuleSanitizer|title = HtmlRuleSanitizer|website = GitHub|date = 13 August 2021}}
Implementations
In PHP, HTML sanitization can be performed using the strip_tags() function at the risk of removing all textual content following an unclosed less-than symbol or angle bracket.{{cite web|url=http://us3.php.net/manual/en/function.strip-tags.php|title=strip_tags|publisher=PHP.NET}} The HTML Purifier library is another popular option for PHP applications.{{Cite web|url=http://htmlpurifier.org/|title=HTML Purifier - Filter your HTML the standards-compliant way!|website=htmlpurifier.org}}
In Java (and .NET), sanitization can be achieved by using the OWASP Java HTML Sanitizer Project.{{Cite web|url=https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project|title = OWASP Java HTML Sanitizer}}
In .NET, a number of sanitizers use the Html Agility Pack, an HTML parser.{{Cite web |url=http://htmlagilitypack.codeplex.com/ |title=HTML Agility Pack - Home |access-date=2013-01-04 |archive-date=2013-01-01 |archive-url=https://web.archive.org/web/20130101170916/http://htmlagilitypack.codeplex.com/ |url-status=dead }}{{Cite web|url=http://eksith.wordpress.com/2011/06/14/whitelist-santize-htmlagilitypack/|title = Whitelist santize with HtmlAgilityPack|date = 14 June 2011}} Another library is HtmlSanitizer.{{cite web |last1=Ganss |first1=Michael |title=HtmlSanitizer |url=https://github.com/mganss/HtmlSanitizer/ |access-date=7 December 2023 |date=5 December 2023}}
In JavaScript there are "JS-only" sanitizers for the back end, and browser-based{{Cite web|url=https://github.com/jitbit/HtmlSanitizer|title=JS HTML Sanitizer|website=GitHub|date=14 October 2021}} implementations that use browser's own Document Object Model (DOM) parser to parse the HTML (for better performance).
References
{{Reflist}}