Re: whitelisting HTML tags

[bugtraq () cgisecurity net]

> I need to tell my development to limit the HTML tags allowed in input to a
> subset that can't be used for XSS.
>
> Any guidelines for this? Obviously <SCRIPT> and <IMG> are out.. but I want a
> whitelist of "safe" tags, not a blacklist of "bad" ones. Also, attributes. A
> list of attributes for each element that CANNOT introduce script code or
> references to background images, etc.

Even if you whitelist certain tags, script execution may still be possible in tag attributes.

Example:

<IMG SRC="javascript:alert(document.cookie);">

Other Examples: http://ha.ckers.org/xss.html


- admin () cgisecurity com
http://www.cgisecurity.com/