Strip out JavaScript, etc.

I need to disply user-entered HTML on the screen. Needless to say, this has led to problems.

Is there any library that will strip out JavaScript, Input tags, etc. from HTML, leaving behind only reasonably safe tags?

Note: For reasons I can't control, I cannot filter out the garbage on input. I need to do it when the info is displayed.

Jonathan Allen

Hi,

you could probably make good use of the Anti Cross Site Scripting library:http://forums.asp.net/1107.aspx.

Grz, Kris.

Correct me if I'm wrong, but that doesn't look like it will work.

What I need to do is strip out only unsafe HTML. I have to be able to leave the other HTML behind. All the methods I saw in the docs are about encoding the output, which is the wrong thing to do.

Jonathan

I would attempt to do this using regular expressions. Are you familiar with regular expressions?

Regular expressions are not really an answer. Besides the fact that regular expressions are totally unsuitable for parsing something as complex as HTML, you still have to figure out for yourself what is safe and what isn't.

What I am looking for a library that understands the difference between safe and unsafe HTML, and is capable of filtering out the latter.

Other than javascript, what would be an example of some unsafe HTML?

Input tags for one.

What happens is that users email us HTML copied and pasted from other sites. Sometimes this email contains input tags. Especially troubling from a stability standpoint is when the input tag has the idea __viewstate. Needless to say, this breaks the real viewstate on the page.

Really any Form tag is also a risk. Though no likely in our case, one doesn't want users creating bogus forms that post their information to email or a web site out of your control.

Well, from what I can understand, your creating an even stronger case for using regular expressions. I feel I'm not completely understanding the scenario properly.

It sounds like you'll need to think about what you consider to be unsafe, and create a list. Armed with this, you'll need to create a list of expressions to match and remove (or replace with nothing).

I'm still not 100% on how/why you need to do this though? Can you talk me through an example - or is there a URL you can direct me too?

From what you've said, I'm assuming that people are filling in a form which emails you the code they entered (or something similar), and that's causing the problem? Perhaps you could try using the depricated <xmp> ... </xmp> tag? (strictly speaking you shouldn't though, I know.)

Stripping Needless Data From HttpContext.Current.Request.Form

I found this nice example of printing data to the default printer of the server when the submit button is clicked. But not sure how to strip out the names of the controls, etc.

Here is the code for those interested:

1Private Sub pd_PrintPage(ByVal sender As Object, ByVal ev As PrintPageEventArgs)23 Dim yPos As Single = 2504 Dim leftMargin As Single = ev.MarginBounds.Left5 Dim topMargin As Single = ev.MarginBounds.Top6 Dim printFont = New Font("Arial", 10)78 Dim sb As StringBuilder = New StringBuilder()910 ' Page title and date/time.11 sb.Append("Maintenance Request")12 sb.Append(Environment.NewLine)13 sb.Append("DateTime: " + DateTime.Now.ToString() + Environment.NewLine)1415 ' Iterate submitted form fields and get field names.16 Dim fieldValue As String17 Dim fieldName As String1819 ' Exclude viewstate and submit button.20 For Each fieldName In HttpContext.Current.Request.Form21 Response.Write("Field Name: " & HttpContext.Current.Request.Form(fieldName) & "<br>")22 If fieldName = "__VIEWSTATE" Or fieldName = "Submit" Then2324 Else25 ' Get the field values.2627 fieldValue = HttpContext.Current.Request.Form(fieldName)2829 ' Add the field names and values to the page.30 ' Break the field values into 50 character segments so it will fit on the paper.31 ' Currently, this only accounts for fields of l50 characters or less.32 ' ISSUE: breaks in the middle of words instead of spaces3334 If fieldValue.Length > 100 Then35 sb.Append(fieldName + ": " + fieldValue.Substring(0, 50) + Environment.NewLine)36 sb.Append(" " + fieldValue.Substring(50, 50) + Environment.NewLine)37 sb.Append(" " + fieldValue.Substring(100, fieldValue.Length - 100) + Environment.NewLine)3839 ElseIf fieldValue.Length > 50 Then40 sb.Append(fieldName + ": " + fieldValue.Substring(0, 50) + Environment.NewLine)41 sb.Append(" " + fieldValue.Substring(50, fieldValue.Length - 50) + Environment.NewLine)42 Else43 sb.Append(fieldName + ": " + fieldValue + Environment.NewLine)4445 End If4647 End If4849 Next50 ev.Graphics.DrawString(sb.ToString(), printFont, Brushes.Black, leftMargin, yPos, New StringFormat())5152 End Sub

There has to be a better way. Any ideas?

Figured it out. Instead of using HttpContext.Current.Request.Form, I am just using the explicit names of the controls and appending the values to the stringbuilder. If anyone needs help with this, please feel free to contact me.