For your URL's about all you can do is make sure that they are valid syntactically (they look like URL's) and you can check them with the LWP module to make sure they actually retrieve a page. If the URL passes these 2 tests it should be acceptable. (who knows what the content of the page it links to is, but at least it "works" as an URL).

There is more danger from accepting text from users. It could contain many harmful (either directly by doing naughty things, or indirectly by just screwing up your formatting) tags. A good technique is to have a limited set of HTML tags that a user could enter and dump any others (HTML::Parser is be good for this). Definitely dropping the tags that could be a major source of problems (script, frame, form, iframe, etc...). If you want to be paranoid, just drop all HTML tags from users and you will probably be OK.

In reply to Re: Untainting URLs and their descriptions by lhoward
in thread Untainting URLs and their descriptions by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.