Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Export clearTags and explain safeTags is not enough #25

Open
Skyfold opened this issue Feb 20, 2022 · 1 comment
Open

Export clearTags and explain safeTags is not enough #25

Skyfold opened this issue Feb 20, 2022 · 1 comment

Comments

@Skyfold
Copy link

Skyfold commented Feb 20, 2022

From the documentation:

You can insert your own custom filtering, but make sure you compose your filtering function with [safeTags] or [safeTagsCustom]

Really this should say:

You can insert your own custom filtering, but make sure you compose your filtering function with (safeTags . clearTags) or (safeTagsCustom . clearTagsCustom)

The problem is, without applying clearTags first, the input may not be sanitized:

Prelude Text.HTML.SanitizeXSS> filterTags safeTags "<iframe></iframe>"
""
Prelude Text.HTML.SanitizeXSS> filterTags safeTags "<script><iframe></iframe>"
"<iframe></iframe>"

This isn't an issue with sanitizeXSS because it composes safeTags with clearTags.

Prelude Text.HTML.SanitizeXSS> sanitizeXSS "<script><iframe></iframe>"
""

I'm happy to make a pull request to fix this.

@snoyberg
Copy link
Member

Sure, a PR would be great.

Skyfold added a commit to Skyfold/haskell-xss-sanitize that referenced this issue Mar 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants