apostrophecms/sanitize-htmlArchived
Sanitize Html
Esta es una librería de sanitización de HTML diseñada para eliminar etiquetas y atributos peligrosos del HTML enviado por el usuario para evitar ataques de cross-site scripting (XSS). Funciona como un filtro de contenido que incluye en una lista blanca elementos y atributos específicos mientras escapa o descarta el marcado no autorizado.
El proyecto incluye un motor de transformación HTML que permite la modificación o reemplazo de etiquetas y atributos utilizando lógica personalizada. También cuenta con un validador de estilos CSS para limpiar propiedades en línea contra patrones permitidos y un sistema para la validación de URL de recursos para restringir nombres de host y esquemas.
La librería proporciona capacidades para la sanitización de entradas de usuario, validación de CSS en línea y transformación dinámica de HTML. Estas funciones se implementan a través de un analizador (parser) que admite el filtrado de etiquetas y la definición de elementos permitidos.
Features
- Cross-Site Scripting Prevention - Prevents cross-site scripting attacks by stripping unauthorized tags and attributes using a whitelist approach.
- HTML Element Filters - Provides a system to define permitted HTML tags and attributes using exact matches, wildcards, or regex.
- URL Scheme Whitelisting - Validates link and resource destinations by restricting permitted URI protocols and hostnames.
- HTML Content Filters - Controls permitted HTML elements and attributes to ensure security and consistent formatting.
- CSS Sanitizers - Cleans and validates inline CSS properties against permitted patterns to prevent injection attacks.
- Element Whitelisting - Retains only specific HTML tags and attributes that match an explicit permitted whitelist.
- HTML Content Sanitization - Removes dangerous tags and attributes from user-submitted HTML to prevent cross-site scripting attacks.
- Input Sanitization Filters - Cleans user-submitted HTML to remove malicious scripts and dangerous elements before rendering.
- Attribute Injection Validators - Uses regular expressions to validate attributes and CSS properties, preventing malicious code injection.
- CSS Security Validators - Cleans inline CSS properties against permitted patterns to ensure safe styling in user content.
- Inline Style Scrubbers - Filters style attributes to ensure only safe CSS properties and values are permitted.
- Custom Handler Transformations - Provides a transformation engine to modify or replace HTML tags and attributes via custom callback logic.
- HTML Document Transformation - Modifies HTML content using custom logic to meet application-specific requirements during cleaning.
- Parser Event Interception - Allows custom logic to be executed during the opening and closing of tags for advanced filtering.
- Tag Discard Policies - Configures whether forbidden tags are discarded, escaped, or converted to plain text.
- Tag Transformations - Modifies or replaces specific tags and attributes using custom logic during the cleaning process.
- Resource URL Validations - Restricts permitted hostnames and schemes in links and frames to ensure content loads from trusted sources.
- Parser Event-Based Filtering - Implements HTML processing by reacting to streaming parser events for open and close tags.
- Streaming DOM Reconstruction - Builds clean output strings by selectively appending parsed tokens that pass security filters.
- Parsing Tools - HTML sanitization tool.
- Security and Sanitization - Simple API for HTML sanitization.
