Filtering JavaScript From HTML Content with AntiSammy

Category: Java , Security

<p>Jason Harwig has posted about AntiSamy, the Java 1.5 compatible library that sanitizes away:

PLAIN TEXT

JAVA:

AntiSamy sanitizer = new AntiSamy();
CleanResults results = sanitizer.scan(request.getParameter("html"));
String html = results.getCleanHTML();
if (!results.getErrorMessages().isEmpty()) {
log.warn("Input contains erorrs");
}

I gave a JavaScript security talk last month, and one of the topics was HTML filtering. I gave examples of how MySpace tried to filter executable code, while still allowing HTML tags for formatting. MySpace, of course, failed to foresee every attack vector, and the Samy worm was born.

HTML filtering was never recommended because it was so difficult to get right, and with no proven libraries, trying to build a solution would almost certainly contain security holes.

3 Comments »

Comments feed TrackBack URI

This is truely a tough nut to crack. I’ll be looking forward to the PHP implementation.
Comment by Marc — December 3, 2007: Kudos to getting this reliably working, but I have to wonder why? Presumably you would never rely on client-side validation before submitting to a database or some-such mechanism, I would hope…
Comment by bclaydon — December 10, 2007: Ok, ignore me, I completely mis-intepretted the post. It’s server-side in Java, excellent. Carry on… :)
Comment by bclaydon — December 10, 2007

Ajax Questions and Answers

Caching and dynamic views
My client does not want to change his cache settings on IE and I'm trying to figure out a way to dynamically update a view each time it is visited. I...

How to change html form tags to ajax
How to change html form tags to...

IE 8 Crashing Problem
Hello Everyone, Here\'s the situation: two iSeries boxes - Dev and Prod both V5R4M0 We\'re using AJAX to dynamically load content using a tabbed...