util.sanitizeHTML(html)
Sanitize the provided HTML (string) to protect against XSS attacks. The algorithm has several steps:
<div>
tag. This will remove tags that are invalid in that context (e.g. <body>
and <head>
).jQuery.parseHTML()
). This prevents inline events from firing and also prevents image GET requests from being sent.<script>
tags.on...
attributes (e.g. onload
, onerror
).javascript:
pseudo-protocol as value.The six simple steps protect against the most common XSS attacks; however, we cannot guarantee bulletproof security here. If you need stronger security, you should always keep an eye on a list XSS attacks and replace the joint.util.sanitizeHTML()
function with your own, more secure version.
Examples:
joint.util.sanitizeHTML('<html><body><p>Hello</p></body></html>'); // => '<p>Hello</p>'
joint.util.sanitizeHTML('<p>Hello</p><script>alert("Hacked");</script>'); // => '<p>Hello</p>'
joint.util.sanitizeHTML('<p>Hello</p><img onload="alert("Hacked");">'); // => '<p>Hello</p><img>'
joint.util.sanitizeHTML('<p>Hello</p><img src="javascript:alert("Hacked");">'); // => '<p>Hello</p><img>'