search

yesodweb / haskell-xss-sanitize

prevent XSS attacks by sanitizing html (this is different then escaping!)
Other
20 stars 15 forks source link

img attribute getting removed #14

Open snap9 opened 7 years ago

snap9 commented 7 years ago

I'm using imgsrc to support high-resolution display images: https://webkit.org/demos/srcset/

<img src="image.jpg" srcset="image-1x.jpg 1x, image-2x.jpg 2x, image-3x.jpg 3x">

Your XSS strips this down to

<img src="image.jpg">

It just gets rid of the srcset. Why, and if srcset isn't really dangerous, can you consider whitelisting it?

gregwebs commented 7 years ago

This is easy to add: I pushed a srcset branch.

However, this attribute is not in my reference implementation: https://github.com/html5lib/html5lib-python/blob/master/html5lib/filters/sanitizer.py A goal of this library is to have 3rd-party vetting of the safety of the sanitization.

gregwebs commented 7 years ago

ok, that implementation is stalled. srcset looks like it can be treated just like src