search

WheatonCS / Lexos

Python/Flask-based website for text analysis workflow. Previous (stable) release is live at:
http://lexos.wheatoncollege.edu
MIT License
119 stars 20 forks source link

Upload security #451

Open scottkleinman opened 8 years ago

scottkleinman commented 8 years ago

As we move forward, we should think about enhancing security for file and url uploads. How can we sanitise the data (particularly where it contains markup)?

czhang03 commented 8 years ago

I think as long as we do not parse or eval stuff, we are fine.

for now xml maybe the most dangerous stuff

scottkleinman commented 8 years ago

Mozilla's Bleach library seems to be the best bet, but it will essentially destroy the markup. This will require some thought.