Comments (3)
Sure, here's an example I put together: https://jsfiddle.net/30ctsyrf/1/
You will see it pop up foo
and foo1
If I used the example you provided, it wouldn't remove the vulnerability. I think the content of the json need to be scrubbed.
<script type="application/ld+json">
{
"@context": "http://json-ld.org/contexts/person.jsonld",
"@id": "http://dbpedia.org/resource/John_Lennon",
"name": "</script><script>alert('foo');</script><script>",
"</script><script>alert('foo1');</script><script>": "1940-10-09",
"spouse": "http://dbpedia.org/resource/Cynthia_Lennon"
}
</script>
from htmlsanitizer.
This will keep script elements of type application/ld+json
:
sanitizer.RemovingTag += (s, e) => e.Cancel = e.Tag is IHtmlScriptElement script
&& script.Type == "application/ld+json";
What exactly do you mean by sanitizing the JSON? Can there be anything embedded in the JSON that might get executed as JavaScript or where is the XSS potential here?
from htmlsanitizer.
I'm getting the following output:
<script type="application/ld+json">
{
"@context": "http://json-ld.org/contexts/person.jsonld",
"@id": "http://dbpedia.org/resource/John_Lennon",
"name": "</script>
Embedded HTML inside the JSON needs to be escaped.
from htmlsanitizer.
Related Issues (20)
- Newer list-style-type values unsupported HOT 1
- Configuration option to bypass changes for security advisory HOT 10
- Sanitize Vue.js scripts HOT 1
- MSO conditional comments HOT 2
- htmlsanitizer is missing NuGet package README file HOT 1
- AngleSharp missing dependency HOT 2
- Url extra escaping HOT 3
- Error on sanitizing simple post without any invalid char. HOT 3
- about slash in background property HOT 1
- Allow outlook conditional comments HOT 1
- Sanitizer removes "px" from the source style attributes when it's "0px" HOT 1
- Properties in @font-face declaration are removed (font-display, mso-generic-font-family, mso-font-alt) HOT 1
- FilterUrl event not raised for relative URLs if baseUrl is used HOT 1
- href's allow inline javascript? HOT 2
- AngleSharp dependency issue in .NET Framework (IIS-hosted WCF service) HOT 9
- RemovingTag and/or RemovingAttribute does not fire for "<BODY ONLOAD=alert('XSS')>" HOT 1
- css attribute white-space is being removed by default HOT 1
- Characters such as < and > are removed, even if they're not a tag
- Unable to load assembly AngleSharp Version 0.17.0 when HtmlSanitizer Initialized HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from htmlsanitizer.