search

mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.51k stars 198 forks source link

How to convert < into &lt; and similar things using HtmlSanitizer.sanitize call #506

Closed gmeghalg closed 7 months ago

gmeghalg commented 7 months ago

Looks like I can't seem to find a proper way to convert a string after calling .sanitize method.

Basically convert '<' into '<' and convert '>' into '>'.

For example,

When given input string 'Test 509 ' Then output string should be 'Test 509 <img src=x onerror=alert(document.cookie) />'

Here's the code I'm using which does not generate above mentioned output

var doc = new HtmlSanitizer(); return doc.Sanitize(text);

Actual output is (see how it removed the 'onerror' javascript code and did not converted < and >)

Input: Test 123 Output: Test 123

Looks like this text does not seems to be working due to js conversion. So, I have attached the fiddle screenshot explaining the issue I'm facing

image

gmeghalg commented 7 months ago

@mganss - Any idea on how can I achieve this?

gmeghalg commented 7 months ago

@mganss ,

Additionally, when I tried to use your online demo with below URL, I got errors (shown below)

image

image

gmeghalg commented 7 months ago

Closing this since I have open a thred in Q&A section which is more suitable than issue section.

Can be found here - https://github.com/mganss/HtmlSanitizer/discussions/507