web:html:sanitizer

About

A sanitizer is a program that will:

This is to avoid script injection and should be used on the server side (ie not client) to validate/transform all inputs.

Description

From

Delete the onerror event handler

<img src=x onerror=alert(1)//>

<img src="x">

Delete the onload and makes the svg XHTML conform

<svg><g/onload=alert(2)//<p>

<svg><g></g></svg>

Delete the iframe

<p>abc<iframe//src=jAva&Tab;script:alert(3)>def</p>

<p>abc</p>

Delete the script node

<math><mi//xlink:href="data:x,<script>alert(4)</script>">

<math><mi></mi></math>

Make the HTML conform

<TABLE><tr><td>HELLO</tr></TABL>
<UL><li><A HREF=//google.com>click</UL>

<table><tbody><tr><td>HELLO</td></tr></tbody></table>
<ul><li><a href="//google.com">click</a></li></ul>