Enhance error messages (to use HTMLPurifier as just an XSS scanner)

ezyang / htmlpurifier

Standards compliant HTML filter written in PHP

http://htmlpurifier.org

GNU Lesser General Public License v2.1

3.07k stars 327 forks source link

Enhance error messages (to use HTMLPurifier as just an XSS scanner) #185

Closed TolstoyDotCom closed 5 years ago

TolstoyDotCom commented 6 years ago

I just want to give HTMLPurifier some HTML and check if the HTML has anything questionable, without changing the HTML.

The closest seems to be using CollectErrors, however that just provides nondescript messages like "rel attribute on <a> removed". Is there a way to add in more details, such as the context, the contents of the rel attribute, etc.?

Or, is there another way to just determine if some HTML contains something bad?

ezyang commented 5 years ago

No, this isn't really something HTML Purifier was designed to do, and it will probably never support this feature.