We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to sanitise user generated attribute values.

These are the:

  • href and title attributes of a tags.
  • src and title attributes of img tags.

How should we process these values to make them safe for the attributes that they belong to?

  • 1
    Be sure to canonicalize the input before filtering. Some characters are representable by more than one Unicode sequence. There is more info here: owasp.org/index.php/Canonicalization,_locale_and_Unicode – Bob Brown Jan 25 '15 at 0:08
  • "In order to be safe, the parser needs to sanitise user generated attribute values." Also, would need to sanitise the following: [xss](http://"onmouseover="alert(1)). – Mark Messa Jan 21 '18 at 3:28
  • "We want to implement a "safe mode" This feature is still to be implemented or the team decided to leave this task to some 3rd party sanitizer (ex: HTML Purifier) ? – Mark Messa Jan 21 '18 at 3:31

Make sure to escape all quote variations (single and double) and restrict the URL in the href and src attribute to an XSS-safe scheme like http: or https: (as opposed to javascript:, data: or whatever).

Also consider running the parser output through HTML Purifier to keep it in a sandbox environment. This will catch weaknesses of your own implementation in case you've overlooked something (which can always happen).

Last but not least, custom HTML markup should always be backed up with Content Security Policy. But this may be beyond the scope of your project.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.