Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris

comment on

( #3333=superdoc: print w/replies, xml ) Need Help??
After I read the recent post about Cross Site Scripting attacks, I sat down and wrote an HTML filter to make user-submitted HTML safe (using HTML::Parser). Then I read some more posts, and followed some links (I particularly liked this one) and then got scared.

You can call malicious code from an <IMG> tag??!! And even stranger, from a <STYLE> tag... (well, I thought it was strange, because STYLE is for, um, formatting, not for running code, but of course this allows for dynamically generated styles).

So, for plain HTML, I think I now know what I can do: I will add the necessary filtering ability to my self-rolled version, test it against the exploits listed in the various articles, and if it doesn't come up to scratch, I'll use HTML::TagFilter as recommended by some (Hell, I'll maybe use that anyway, but this is the first time I've been able to get HTML::Parser to do anything useful, so I'm enjoying reinventing this wheel...)

But if I want users to be able to submit their own Stylesheets, how do I parse the CSS entry to make sure they aren't adding malicious code? Can I just filter out @ and expression()? Surely there must be a pre-rolled solution? (I found CSS::SAC which looks like a CSS parser, but didn't seem to have any documentation on how to use it for this kind of eventuality.

I think that one suggestion involved creating a user interface to limit what CSS is entered, which I don't want to have to do if I can avoid it!!


In reply to Safe CSS Stylesheets by osfameron

Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":

  • Are you posting in the right place? Check out Where do I post X? to know for sure.
  • Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
    <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
  • Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
  • Want more info? How to link or or How to display code and escape characters are good places to start.
Log In?

What's my password?
Create A New User
Domain Nodelet?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others contemplating the Monastery: (5)
As of 2021-12-02 07:26 GMT
Find Nodes?
    Voting Booth?
    R or B?

    Results (17 votes). Check out past polls.