sanitize HTML style tag in java to prevent javascript injection from WYSIWYG

Question

There are known XSS attacks like:

<DIV STYLE="color: red; width: expression(alert('XSS')); background-image: url('expression.png') ">

Or

<DIV STYLE="background-image: url(javascript:alert('XSS'));  border-image: url(images/javascript.png) 30 round round;">

Or

<META HTTP-EQUIV=Refresh CONTENT="1; URL=javascript:alert(/xxs/.source)">empty

And i need to sanitize html to this:

<DIV STYLE="color: red; background-image: url('expression.png') ">

Or

<DIV STYLE="border-image: url(images/javascript.png) 30 round round;">

Or

empty

Is there java library, that provide such protections?

Erlend · Accepted Answer · 2013-06-19 22:02:44Z

1

This one for sure: https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project

and maybe this one (faster): https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project

answered Jun 19, 2013 at 22:02

Erlend

4,40625 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

msangel Over a year ago

I tried AntiSamy and it is almost work, however i get one very strange behavior of the library. I have created question, but there is no answer yet: stackoverflow.com/questions/19343035 I thnk you can know answer, so asking you directy =D

Collectives™ on Stack Overflow

sanitize HTML style tag in java to prevent javascript injection from WYSIWYG

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related