3

We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to sanitise user generated attribute values.

These are the:

  • href and title attributes of a tags.
  • src and title attributes of img tags.

How should we process these values to make them safe for the attributes that they belong to?

3
  • 1
    Be sure to canonicalize the input before filtering. Some characters are representable by more than one Unicode sequence. There is more info here: owasp.org/index.php/Canonicalization,_locale_and_Unicode
    – Bob Brown
    Jan 25, 2015 at 0:08
  • "In order to be safe, the parser needs to sanitise user generated attribute values." Also, would need to sanitise the following: [xss](http://"onmouseover="alert(1)).
    – Mark Messa
    Jan 21, 2018 at 3:28
  • "We want to implement a "safe mode" This feature is still to be implemented or the team decided to leave this task to some 3rd party sanitizer (ex: HTML Purifier) ?
    – Mark Messa
    Jan 21, 2018 at 3:31

1 Answer 1

1

Make sure to escape all quote variations (single and double) and restrict the URL in the href and src attribute to an XSS-safe scheme like http: or https: (as opposed to javascript:, data: or whatever).

Also consider running the parser output through HTML Purifier to keep it in a sandbox environment. This will catch weaknesses of your own implementation in case you've overlooked something (which can always happen).

Last but not least, custom HTML markup should always be backed up with Content Security Policy. But this may be beyond the scope of your project.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .