Re: Is it possible to strip/disallow event attributes on the serverside?

  •  09-11-2006, 11:02 AM

    Re: Is it possible to strip/disallow event attributes on the serverside?

    Thomas :
     
    CuteEditor haven't provide that function .
    But CuteEditor can convert HTML to XmlDocument , you can interate the XmlDocument and remove all scripts .
     
    Here is the example code , you can use it like that:
     
    string cleanHTML=RemoveScripts(Editor1.Text);
     
    ----

      static public string RemoveScripts(string text)
      {
       XmlDocument doc = EditorUtility.ConvertToXmlDocument(text);
       RemoveScriptsRecursive(doc.DocumentElement);
       return doc.OuterXml;
      }
      static public void RemoveScriptsRecursive(XmlElement element)
      {
       if(ShouldRemove(element))
       {
        element.ParentNode.RemoveChild(element);
        return;
       }
       foreach(XmlElement child in element.SelectNodes("*"))
       {
        RemoveScriptsRecursive(child);
       }
      }
      static bool ShouldRemove(XmlElement element)
      {
       string name=element.LocalName.ToLower();
       //check the element name
       switch(name)
       {
        case "link"://maybe link to another css that contains scripts(behavior,expression)
        case "script":
         return true;
       }
       //check the attribute
       foreach(XmlAttribute attr in element.Attributes)
       {
        string attrname=attr.LocalName.ToLower();
        //<img onclick=....
        if(attrname.StartsWith("on"))
         return true;
        string val=attr.Value.ToLower();
        //<a href="javascript:scriptcode()"..
        if(val.IndexOf("script")!=-1)
         return true;
        //<a style="behavior:url(http://another/code.htc)"
        if(attrname=="style")
        {
         if(val.IndexOf("behavior")!=-1)
          return true;
         if(val.IndexOf("expression")!=-1)
          return true;
        }
        
       }
       return false;
      }
     
    Regards , Terry .
     
View Complete Thread