Is it possible to strip/disallow event attributes on the serverside?

Last post 09-12-2006, 5:17 AM by Anonymous. 2 replies.
Sort Posts: Previous Next
  •  09-10-2006, 12:54 PM 22571

    Is it possible to strip/disallow event attributes on the serverside?

    I am very interested in ensuring that the html input I get from our users does not contain any javascript. I have tried to put javascript in an html tag in my current installation which CuteEditor does not seem to cleanup - see example below.

    Is there anyway CuteEditor will/can do this or will I have to clean the input myself?


    Example:

    <div onmouseover="top.location='http://www.cafepress.com/cp/sotd.aspx?storeid=pearls'">Writing something here</div>


    This forum if nothing else seems to disallow javascript event attributes.


    /Thomas
  •  09-11-2006, 11:02 AM 22587 in reply to 22571

    Re: Is it possible to strip/disallow event attributes on the serverside?

    Thomas :
     
    CuteEditor haven't provide that function .
    But CuteEditor can convert HTML to XmlDocument , you can interate the XmlDocument and remove all scripts .
     
    Here is the example code , you can use it like that:
     
    string cleanHTML=RemoveScripts(Editor1.Text);
     
    ----

      static public string RemoveScripts(string text)
      {
       XmlDocument doc = EditorUtility.ConvertToXmlDocument(text);
       RemoveScriptsRecursive(doc.DocumentElement);
       return doc.OuterXml;
      }
      static public void RemoveScriptsRecursive(XmlElement element)
      {
       if(ShouldRemove(element))
       {
        element.ParentNode.RemoveChild(element);
        return;
       }
       foreach(XmlElement child in element.SelectNodes("*"))
       {
        RemoveScriptsRecursive(child);
       }
      }
      static bool ShouldRemove(XmlElement element)
      {
       string name=element.LocalName.ToLower();
       //check the element name
       switch(name)
       {
        case "link"://maybe link to another css that contains scripts(behavior,expression)
        case "script":
         return true;
       }
       //check the attribute
       foreach(XmlAttribute attr in element.Attributes)
       {
        string attrname=attr.LocalName.ToLower();
        //<img onclick=....
        if(attrname.StartsWith("on"))
         return true;
        string val=attr.Value.ToLower();
        //<a href="javascript:scriptcode()"..
        if(val.IndexOf("script")!=-1)
         return true;
        //<a style="behavior:url(http://another/code.htc)"
        if(attrname=="style")
        {
         if(val.IndexOf("behavior")!=-1)
          return true;
         if(val.IndexOf("expression")!=-1)
          return true;
        }
        
       }
       return false;
      }
     
    Regards , Terry .
     
  •  09-12-2006, 5:17 AM 22617 in reply to 22587

    Re: Is it possible to strip/disallow event attributes on the serverside?

    Hi Terry

    Great solution.
    Thanks a lot for the code example, which I will def. use as a base for my anti-xss filter.


    Thomas
View as RSS news feed in XML