Re: whitelisting HTML tags

[Jeff Robertson]

| I need to tell my development to limit the HTML tags allowed in
| input to a subset that can't be used for XSS. Any guidelines for
| this?

You need three levels of whitelisting:

  * For allowed _tags_

  * For allowed _attributes_ for the allowed tags (separate attribute
    whitelist for each tag)

      To avoid e.g. onload, onclick and stuff

      If you allow an "img" tag, you could allow the "src" and "alt"
      attributes, and discard the rest.

  * For allowed _attribute_values_ for the allowed attributes

      To avoid e.g. href="javascript:..."

      You would allow src="http:..." and src="ftp:", and discard the
      rest.

Sverre.

-- 
shh_at_thathost.com               My web security book: Innocent Code
http://shh.thathost.com/       http://innocentcode.thathost.com/