Closed RaptorCZ closed 1 year ago
mganss
commented
3 years ago You'll have to use events:
sanitizer.RemovingTag += (s, e) => e.Cancel = e.Tag is AngleSharp.Svg.Dom.SvgElement;
sanitizer.RemovingAttribute += (s, e) => e.Cancel = e.Tag is AngleSharp.Svg.Dom.SvgElement;
RaptorCZ
commented
3 years ago ok and any way to keep svg and prevent <svg/onload=alert()> xss?
mganss
commented
3 years ago If you want to keep the event-based approach allowing all SVG elements and their attributes, you'll have to implement your own logic. Something like this:
sanitizer.RemovingAttribute += (s, e) => e.Cancel = e.Tag is AngleSharp.Svg.Dom.SvgElement
&& !e.Attribute.Name.StartsWith("on");Another option that aligns better with the original design of the sanitizer is to add all the elements and attributes you actually want to allow to AllowedTags and AllowedAttributes.
Do you really want to allow user contributed SVG?
RaptorCZ
commented
3 years ago Well, this is not exactly about SVG itself. I need to sanitize html parts in CMS that can contain SVG sprites. And also I need sanitize inputs to prevent user enter some types of XSS strings. Img onLoad and SVG onLoad is just an example.
mganss
commented
3 years ago So users should be allowed to enter SVG?
RaptorCZ
commented
3 years ago User can enter any text to form inputs, but some are rendered back as html. So I need to strip XSS attempts. Pentesters are using OWASP samples and <svg/onload is almost the same as any script tag. Text from all inputs and other sources should be sanitized with one helper function. Some texts are external and can contain SVG parts, mostly icons, with user entered texts.
So for now I just need to strip onload attributes from
mganss
commented
3 years ago If user entered SVG is really a possible source of XSS then it's probably best to compile a list of elements and attributes you want to allow and add these to AllowedTags and AllowedAttributes.
I'm using SVG icons in application, but sanitizer removes it. Tried to allow
svgtag, but it is not working. All svg nested tags are removed.How to solve it?
SVG example: