Disable all javascript inside div

Question

Is there any way for me to disable all sort of JavaScript inside a particular div?
I initially thought the <noscript> tag was meant for that, but it turns out I was wrong.

Here is what I am looking for:

<some-sort-of-tag-here>
    <script>
        alert('test');
    </script>
</some-sort-of-tag-here>

Would get rendered as:

<script>
    alert('test');
</script>

Rather than executing the script. This would prevent any form of XSS and other external JavaScript (that has been included in the head) would be able to modify the given tag.

I may be completely wrong here and such a tag may not exist at all, but please help me out here. I feel such a tag would be the simplest solution to XSS. There's no need to worry about any script executing inside the tag, (which means all user content can be wrapped in that tag), while all website-included javascript would be able to modify the content of the page as required.

How would I proceed with creating a tag inside which all content is treated as pure HTML only and not execute any form of JavaScript inside it?

You can sanity check user content in JS. As far as I'm aware there is no specific tag to prevent it. That's entirely up to you. It could be that you're using a framework which is already actively protecting against user content. General rule of thumb is that users are all dodgy hacking scumbags, and you should validate everything. Depending on what you're using, there is likely already a module for it. — NoGall
– NoGall, Commented Mar 3, 2018 at 20:54
@LokiSinclair Yes you're right. I am currently cleaning my user inputs. However, if I had such a tag, I wouldn't have to worry about code being injected from somewhere else (like a referrer or something). Makes life a lot easier. :P If only the HTML spec had such a feature :P — Rakshith Ravi
– Rakshith Ravi, Commented Mar 3, 2018 at 21:00

Stanislas · Accepted Answer · 2018-03-03 21:04:52Z

2

I'm afraid a tag like that doesn't exist, you'll have to html-encode the contents yourself.

So that this:

<script>
    alert('test');
</script>

Becomes this:

&lt;script&gt;
    alert('test');
&lt;/script&gt;

Also note that if there was a safe tag, like this:

<safe>
    <script>
        alert('test');
    </script>
</safe>

Anyone could circumvent it by making their content:

</safe>
<script>
    alert('test');
</script>
<safe>

edited Mar 3, 2018 at 21:04

answered Mar 3, 2018 at 20:58

Stanislas

2,0401 gold badge14 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Rakshith Ravi Over a year ago

Yes, I agree. People could walk around the safe tag. I was originally thinking of replacing all occurrences of the </safe> tag with an empty string to prevent escaping it, but then that's the same as replacing the <script> tag isn't it? Oh well. We're back to square one

Stanislas Over a year ago

Most server-side languages have a way of HTML-encoding content. Javascript however does not, but there are plenty of example of custom solutions on stack overflow.

pastaleg · Accepted Answer · 2018-03-03 21:04:07Z

1

Interesting concept. Do you want this to be able to display the code without running it? If so, the xmp tag could be one way.

<xmp>
<script>
    alert('test');
</script>
</xmp>

However xmp is deprecated and is not guaranteed to work on all browsers (although most do it correctly). So a hack around is to use a textarea with added formatting. Like this:

<textarea disabled="true" style="border: none;background-color:white;">
    <script>
        alert('test');
    </script>
</textarea>

edited Mar 3, 2018 at 21:04

answered Mar 3, 2018 at 21:01

pastaleg

1,8382 gold badges19 silver badges25 bronze badges

5 Comments

Rakshith Ravi Over a year ago

Wait...what? HTML gets rendered inside a textarea?

pastaleg Over a year ago

No, just the plaintext, keeping the tags as they are written.

Stanislas Over a year ago

What if my content is: </textarea><script>alert...?

Rakshith Ravi Over a year ago

Ahhh...there's the rub. I was thinking of having something that can render HTML, but not execute JavaScript. So that we can have this tag at the beginning of the body tag and avoid any form of script executing while still render HTML content

pastaleg Over a year ago

@Stanislas true, I was trying to avoid it with disabled=true to not let users edit the inside, but if the content is submitted by the user anyway, there needs to be a check that removes that tag

Collectives™ on Stack Overflow

Disable all javascript inside div

2 Answers 2

2 Comments

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related