apostrophecms/sanitize-htmlArchived
Sanitize Html
This is an HTML sanitization library designed to remove dangerous tags and attributes from user-submitted HTML to prevent cross-site scripting attacks. It functions as a content filter that whitelists specific elements and attributes while escaping or discarding unauthorized markup.
The project includes an HTML transformation engine that allows for the modification or replacement of tags and attributes using custom logic. It also features a CSS style validator to clean inline properties against permitted patterns and a system for resource URL validation to restrict hostnames and schemes.
The library provides capabilities for user input sanitization, inline CSS validation, and dynamic HTML transformation. These functions are implemented via a parser that supports tag filtering and the definition of allowed elements.
Features
- Cross-Site Scripting Prevention - Prevents cross-site scripting attacks by stripping unauthorized tags and attributes using a whitelist approach.
- HTML Element Filters - Provides a system to define permitted HTML tags and attributes using exact matches, wildcards, or regex.
- URL Scheme Whitelisting - Validates link and resource destinations by restricting permitted URI protocols and hostnames.
- HTML Content Filters - Controls permitted HTML elements and attributes to ensure security and consistent formatting.
- CSS Sanitizers - Cleans and validates inline CSS properties against permitted patterns to prevent injection attacks.
- Element Whitelisting - Retains only specific HTML tags and attributes that match an explicit permitted whitelist.
- HTML Content Sanitization - Removes dangerous tags and attributes from user-submitted HTML to prevent cross-site scripting attacks.
- Input Sanitization Filters - Cleans user-submitted HTML to remove malicious scripts and dangerous elements before rendering.
- Attribute Injection Validators - Uses regular expressions to validate attributes and CSS properties, preventing malicious code injection.
- CSS Security Validators - Cleans inline CSS properties against permitted patterns to ensure safe styling in user content.
- Inline Style Scrubbers - Filters style attributes to ensure only safe CSS properties and values are permitted.
- Custom Handler Transformations - Provides a transformation engine to modify or replace HTML tags and attributes via custom callback logic.
- HTML Document Transformation - Modifies HTML content using custom logic to meet application-specific requirements during cleaning.
- Parser Event Interception - Allows custom logic to be executed during the opening and closing of tags for advanced filtering.
- Tag Discard Policies - Configures whether forbidden tags are discarded, escaped, or converted to plain text.
- Tag Transformations - Modifies or replaces specific tags and attributes using custom logic during the cleaning process.
- Resource URL Validations - Restricts permitted hostnames and schemes in links and frames to ensure content loads from trusted sources.
- Parser Event-Based Filtering - Implements HTML processing by reacting to streaming parser events for open and close tags.
- Streaming DOM Reconstruction - Builds clean output strings by selectively appending parsed tokens that pass security filters.
- Parsing Tools - HTML sanitization tool.
- Security and Sanitization - Simple API for HTML sanitization.
