Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a ksh script (Korn Shell Script) that generates a static HTML file from websites. How can I ensure that the output HTML file will not contain any bad <script>'s (bad JavaScript)? It's OK to do this:

sed 's/<script>//g'

But what if the <script> is obfuscated?

share|improve this question
1  
It's not clear what you're asking. What's the threat here? How are you using those static HTML files? Also, JavaScript can be embedded in the HTML elements. For example <a href="#" onclick="alert('alert')"></a> –  Adnan May 16 '13 at 10:28
    
The problem is defining and recognizing 'bad' in context. I'm afraid you've asked a question without an answer. Refine it and add some specifics. –  schroeder May 16 '13 at 14:41
    
You may want to consider a way to extract good content since it may be easier to define. Otherwise, you may be able to look at something like noscript which is licensed under GPL to get a better idea of what is 'bad' scripting and how to remove it. –  chuck May 16 '13 at 15:23
add comment

1 Answer

up vote 0 down vote accepted

Sounds like you're trolling web sites. When you do that - you get whatever content is on the site including scripts.

Modern web sites basically are useless without JS - so I don't see how you can excise the JS and still have functional content unless you're trying to get textual/graphic content for fun and profit....

Without knowing what is the object of this exercise - I would highly recommend loading the content and it's scripts on a test server on a network segment without connectivity to the rest of your network. Then you can fool around to your heart's content.

Hope this helps.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.