search

gbirke / Sanitize.js

Sanitize.js is a whitelist-based HTML sanitizer.
http://github.com/gbirke/Sanitize.js
339 stars 63 forks source link

Sanitize isn't doing anything? #16

Open flound1129 opened 9 years ago

flound1129 commented 9 years ago

What am I doing wrong here?

http://jsfiddle.net/fe9pd8uy/

johnsonjo4531 commented 9 years ago

It does work it just returns a document fragment instead of 'foo' like as expected in the docs. Perhaps you want to replace the element with the filtered element like this. http://jsfiddle.net/fe9pd8uy/3/

flound1129 commented 9 years ago

Shouldn't the default code strip all tags and just leave 'foo'? Why is the img tag still there?

johnsonjo4531 commented 9 years ago

What it does when you call sanitize is return a sanitized node. It does not modify the node directly that you select. You need to replace the un-sanitized node with the sanitized one. I tried to explain it a little more in this fiddle what I did in my last fiddle. http://jsfiddle.net/fe9pd8uy/5/

I get the feeling that if you're trying to prevent XSS you probably should never have unsafe dom elements on your page so you would do it more like this. This might be a general use case if that's your case. http://jsfiddle.net/fe9pd8uy/6/.

Sorry for the late reply.

flound1129 commented 9 years ago

OK thank you