search

yesodweb / haskell-xss-sanitize

prevent XSS attacks by sanitizing html (this is different then escaping!)
Other
20 stars 15 forks source link

Parser improperly handles optional tags under html5 rules #20

Open tysonzero opened 2 years ago

tysonzero commented 2 years ago

https://html.spec.whatwg.org/multipage/syntax.html#optional-tags

Minimal incorrect example:

-- current
sanitizeBalance "<td>foo<td>bar" == "<td>foo<td>bar</td></td>"

-- correct
sanitizeBalance "<td>foo<td>bar" == "<td>foo</td><td>bar</td>"

-- potentially an option depending on semantics of "balanced"
sanitizeBalance "<td>foo<td>bar" == "<td>foo<td>bar"

If html4 / xhtml5 sanitizing is also desired then separate functions/modules may be needed.