jsoup 白名单宽松模式对于所见即所得编辑器来说过于严格

发布于 2025-01-04 05:04:37 字数 746 浏览 2 评论 0原文

我正在尝试使用 jsoup 来清理从我的客户端中的所见即所得发布的 html（碰巧是tinymce）

宽松模式似乎不够宽松，因为默认情况下它会删除 span 元素和任何样式属性。

例如

String text = "<p style="color: #ff0000;">foobar</p>";

   Jsoup.clean(text, Whitelist.relaxed());

将输出

<p>foobar</p>

并被

<span>foobar</span>

完全删除。

有谁有使用 Jsoup 消除 XSS 攻击的可能性并且仍然允许上述元素和属性通过的经验吗？

编辑：我已经接受了以下内容。有人能建议一下这有多脆弱吗？

Jsoup.clean(pitch, Whitelist.relaxed().addTags("span").addAttributes(":all","style"));

编辑 2：有人在生产中使用过 owasp 库吗？它看起来可以正确消毒，同时保留正确的造型。 OWASP

原文

I'm attempting to use jsoup to sanitize the the html posted from a wysiwyg in my client (tinymce as it happens)

The relaxed mode appears not to be relaxed enough as by default it strips span elements and any style attributes.

String text = "<p style="color: #ff0000;">foobar</p>";

   Jsoup.clean(text, Whitelist.relaxed());

would output

<p>foobar</p>

and

<span>foobar</span>

would be removed entirely.

Does anyone have any experience of using Jsoup to eradicate the possibility of XSS attacks and still allow the above elements and attributes through?

Edit: I have gone with the following. Could anyone advise on how vulnerable this is?

Jsoup.clean(pitch, Whitelist.relaxed().addTags("span").addAttributes(":all","style"));

Edit 2: Has anybody used the owasp library in production. It looks to correctly sanitize while preserving the correct styling. OWASP

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

垂暮老矣 2025-01-11 05:04:37

看来使用 style 属性有可能存在 XSS。

XSS 攻击和样式属性

http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/

http://www.acunetix.com/websitesecurity/cross-site-scripting.htm （查看DIV 部分，我认为它对于 SPAN 的工作原理相同）

这是我编写的一些代码，用于测试上一个链接中的示例。

    text = "<span style=\"width: expression(alert('XSS'));\">";
    System.out.println(Jsoup.clean(text, org.jsoup.safety.Whitelist.relaxed().addTags("span").addAttributes(":all","style")));

它准确地输出输入。如果这确实是 XSS 向量，那么您仍然可能遇到麻烦。

It seems that it is possible to have XSS using the style attribute..

XSS attacks and style attributes

http://www.thespanner.co.uk/2007/11/26/ultimate-xss-css-injection/

http://www.acunetix.com/websitesecurity/cross-site-scripting.htm (Look at the DIV section, which I would assume works the same for SPAN)

Here is some code I wrote to test the example in the last link..

    text = "<span style=\"width: expression(alert('XSS'));\">";
    System.out.println(Jsoup.clean(text, org.jsoup.safety.Whitelist.relaxed().addTags("span").addAttributes(":all","style")));

It outputs the input exactly. If that is truly an XSS vector, then you could still be in trouble.

回复收藏 0 原文

~没有更多了~