Is it safe to use createHTMLDocument to sanitize HTML?

Question

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this:

function sanitize(string) {
  var elm = document.implementation.createHTMLDocument().body;
  elm.innerHTML = string;
  // traverse and filter elm to only allow whitelisted elements and attributes
  // e.g. use https://github.com/gbirke/Sanitize.js
  var cleaned_fragment = whitelist_filter(elm);
  elm = document.implementation.createHTMLDocument().body;
  elm.appendChild(cleaned_fragment);

  return elm.innerHTML;
}

It seems to work fine with all XSS attacks i've throw at it (no script evaluation or requests triggered). But I got a feeling it might be a bad idea, im I missing something?

I've created a jsfiddle if someone wants to experiment.

Answer 1

You should use the DOMParser to parse HTML when available, and only fall back to DOMImplementation.createHTMLDocument if the former is unavailable.

In Opera Presto, I observed network activity when I passed <img src=...> (but not <video>).
Internet Explorer 9- is worse: media, styles and event listeners will be activated with this method. IE10+ supports DOMParser, so if your audience uses IE10+, then you're safe.

Answer 2

Refering innerHTML of generated HTMLElement causes mXSS - a kind of DOM based XSS.

e.g, the code following causes mXSS at IE.

var s = "<listing>&lt;img src=1 onerror=alert(1)&gt;</listing>";
var parser = new DOMParser();
var doc = parser.parseFromString( s, "text/html" );
div.innerHTML = doc.body.innerHTML;

therefore, you have to manipulate as HTMLElement, don't refer innerHTML.

div.appendChild( doc.body.childNodes[ 0 ] );

see http://utf-8.jp/public/20140807/shibuyaxss.pdf and http://utf-8.jp/public/rickdom/