I recently posted this question on Code Review and it was recommended that I ask you guys about it.
Basically, this will be used to allow users to generate formatted content. It gets put inside of HTML tags, so I don't have to worry about an attacker breaking out of an attribute. If that's not clear, here's an example:
<div>
Generated content
</div>
Edit: I'm not inserting the content into an attribute, so escaping quotes isn't a concern. I know I still have to check for bad attributes inside the user-generated content, which is what a large portion of the script is for.
I've established that I'm vulnerable to an attacker posting a malicious link or posting a tracking image, but that's something I'm willing to accept. I don't think you can prevent that without white listing URLs, which would also dramatically reduce the freedom users have. If there is a feasible way to fix this vulnerability, I'd love to hear about it.
I've read the OWASP XSS cheat sheet, and I think I have all of those bases covered.
What do I have to worry about outside of that cheat sheet? Did I miss anything on it? Is my code future-proof? Am I in way over my head? Should I just switch to BBCode or Markup?
div
wrapper around user-submitted code does not affect the interpretation of attributes in it, and e.g.onclick=...
would allow simple injection of JavaScript.</body>
gets stripped and the post would appear empty