Hi

Belated thanks for the responses. I thought I'd update with what I did. I got sidetracked from this project a bit but I'm back into it now.

HTML::StripScripts looks like what I need: I'm more concerned about XSS attacks than anything else. I'd not found that in the various searchs that I did.

I did some further testing of HTML::Defang and it's pretty impressive. Example: 

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&
+#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

[download]

Becomes: 

<IMG defang_SRC=javascript:alert('XSS')>

[download]

Note the lack of semicolons on the encoded character references in an attempt to confuse filters. (taken from ha.ckers.org/xss.html)

I will do some similar tests on HTML::StripScripts and post the results. This module has some options that I may ind useful compared to HTML::Defang (escape disallowed tags with &lt;/&gt; so they appear on the page, for example) - to be investigated and tested.

Looking into the posibilities has made me think seriously about disallowing HTML entry at all and using another markup language. That still has to be tested for allowing scripts though ;-)

Cheers

FalseVinylShrub

Disclaimer: Please review and test code, and use at your own risk... If I answer a question, I would like to hear if and how you solved your problem.

In reply to Re: HTML cleanup of user submitted content by FalseVinylShrub
in thread HTML cleanup of user submitted content by FalseVinylShrub

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.