WebApp Sec mailing list archives

RE: whitelisting HTML tags


From: "Tim Hollebeek" <tholleb () teknowledge com>
Date: Mon, 7 Nov 2005 10:46:49 -0800

 
I'm fond of the BB/Markdown sorts of solutions, which use an 
HTML-like language which you translate into HTML.  If your 
parser tosses things it doesn't understand, this can be a 
good solution to the (often real) requirement of "we need to 
let users enter more than plain text."

You're proposing a small language L where the input is translated
into a safe subset of HTML if the input is in L, and rejected otherwise.

What are the advantages of this over the special case L = the safe
subset (and the translation is the identity function), which we were 
discussing?

-Tim



Current thread: