Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>It's unclear what programming language you're using or are preferring, but in Java there's <a href="http://jsoup.org/" rel="nofollow noreferrer">Jsoup</a>, which is a pretty slick HTML parser API which contains among others a HTML cleaner based on a customizable whitelist of HTML tags and attributes (unfortunately no CSS rules since that's completely out the scope of a HTML parser). Here's an extract of relevance from <a href="http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer" rel="nofollow noreferrer">its site</a>.</p> <blockquote> <h2><a href="http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer" rel="nofollow noreferrer">Sanitize untrusted HTML</a></h2> <h3>Problem</h3> <p>You want to allow untrusted users to supply HTML for output on your website (e.g. as comment submission). You need to clean this HTML to avoid <a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="nofollow noreferrer">cross-site scripting</a> (XSS) attacks.</p> <h3>Solution</h3> <p>Use the jsoup HTML <a href="http://jsoup.org/apidocs/org/jsoup/safety/Cleaner.html" rel="nofollow noreferrer"><code>Cleaner</code></a> with a configuration specified by a <a href="http://jsoup.org/apidocs/org/jsoup/safety/Whitelist.html" rel="nofollow noreferrer"><code>Whitelist</code></a>.</p> <pre><code>String unsafe = "&lt;p&gt;&lt;a href='http://example.com/' onclick='stealCookies()'&gt;Link&lt;/a&gt;&lt;/p&gt;"; String safe = Jsoup.clean(unsafe, Whitelist.basic()); // now: &lt;p&gt;&lt;a href="http://example.com/" rel="nofollow"&gt;Link&lt;/a&gt;&lt;/p&gt; </code></pre> </blockquote> <p>The <a href="http://jsoup.org/apidocs/org/jsoup/safety/Whitelist.html" rel="nofollow noreferrer"><code>Whitelist</code></a> class itself contains several predefinied whitelists which may be of use, like <a href="http://jsoup.org/apidocs/org/jsoup/safety/Whitelist.html#basic%28%29" rel="nofollow noreferrer"><code>Whitelist#basic()</code></a> and <a href="http://jsoup.org/apidocs/org/jsoup/safety/Whitelist.html#relaxed%28%29" rel="nofollow noreferrer"><code>Whitelist#relaxed()</code></a>.</p> <p>For .NET, there's by the way a Jsoup port with the name <a href="http://nsoup.codeplex.com/" rel="nofollow noreferrer">NSoup</a></p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload