search

mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.52k stars 198 forks source link

data<text removes <text part instead of sanitizing to data&lt;text #464

Closed sg2707 closed 9 months ago

sg2707 commented 9 months ago

Steps to reproduce:

Sanitise the following text data<text

Actual output: data

expected: data&lt;text

image

mganss commented 9 months ago

This is by design, see #91 and #126. See https://github.com/mganss/HtmlSanitizer/wiki/Examples#ex4-encode-non-html-before-sanitizing on how to deal with non-HTML input.