Cleaning mixed type <script> tags

Posted by yossale on Stack Overflow See other posts from Stack Overflow or by yossale
Published on 2010-04-26T12:39:16Z Indexed on 2010/04/26 12:43 UTC
Read the original article Hit count: 212

Filed under:

jave

|

html-sanitizing

|

cyberneko

I'm cleaning HTML using cyberneko and xerces. However , some $#@@!@@ websites still use BOTH

<script>...</script> and <script.../>

So what happens is this : given

<script..../> <div> Some Text </div> <script> scripting stuff </script> ,

neko parses all the above line as a script , so I get

<script..../> &lt div &gt Some Text &lt/div &gt &lt script &gt scripting stuff </script> ,

And then I lose all the inside content :(

Any advice?

© Stack Overflow or respective owner

Related posts about jave

JAVE function call form JSP page is not returning value

as seen on Stack Overflow - Search for 'Stack Overflow'
I am calling a java function from JSP page which returns file name after creationg a XML file. In some cases where size of file is large(Java function execution takes much time due to large data) it is returning blank where as XML file is genertaed after some time. Can any one help me to get the file… >>> More
How to use infinit live streams with JAVE library? (Java, ffmpeg)

as seen on Stack Overflow - Search for 'Stack Overflow'
So I want to use JAVE to save mp3 radio stream to my File system. I have this code for file saving but what shall I do to save a stream (stop on timer for ex) File source = new File("source.wav"); File target = new File("target.mp3"); AudioAttributes audio = new AudioAttributes(); audio.setCodec("libmp3lame"); audio… >>> More
Difference between internet and Desktop jave EE app server

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello. I need some clarification. I know that in order to run a java EE project, one needs a java EE compliant application server, such as tomcat, jboss, glashfish, etc. But, i download these to my desktop, but how about when i run it online? Are Jboss, tomcat, glashfish, etc. application servers… >>> More
Time consts in Java?

as seen on Stack Overflow - Search for 'Stack Overflow'
Is there a Java package with all the annoying time consts , like miliseconds/seconds/minutes in a minute / hour /day / year ? I'd hate to duplicate something like that Thanks! >>> More
Why does 12:20 PM parse to 0:20 on the next day?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using java.text.SimpleDateFormat to parse string representations of date/time values inside an XML document. I'm seeing all times that have an hour value of 12 shifted by 12 hours into the future, i. e. 20 minutes past noon gets parsed to mean 20 minutes past midnight the following day. I wrote… >>> More

Related posts about html-sanitizing

Why use a whitelist for HTML sanitizing?

as seen on Stack Overflow - Search for 'Stack Overflow'
I've often wondered -- why use a whitelist as opposed to a blacklist when sanitizing HTML input? How many sneaky HTML tricks are there to open XSS vulnerabilities? Obviously script tags and frames are not allowed, and a whitelist would be used on the fields in HTML elements, but why disallow most… >>> More
Sanitizing input for display in view when using simple_format

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm trying to figure out the right way to display comments such that newlines and links are displayed. I know that usually, you should display user-inputs only when escaping html with h(). That of course won't display newlines or links, so I found the simple_format and auto_link methods. What… >>> More
Sanitize HTML before storing in the DB or before rendering? (AntiXSS library in ASP.NET)

as seen on Stack Overflow - Search for 'Stack Overflow'
I have an editor that lets users add HTML that is stored in the database and rendered on a web page. Since this is untrusted input, I plan to use Microsoft.Security.Application.AntiXsSS.GetSafeHtmlFragment to sanitize the HTML. Should I santiize before saving to the database or before rendering… >>> More
Cleaning mixed type <script> tags

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm cleaning HTML using cyberneko and xerces. However , some $#@@!@@ websites still use BOTH <script>...</script> and <script.../> So what happens is this : given <script..../> <div> Some Text </div> <script> scripting stuff </script> , neko… >>> More