Quarantining crap HTML?
me at philip-skinner.co.uk
Thu May 23 08:09:29 BST 2013
On 05/22/2013 07:53 PM, David Dorward wrote:
> On 22 May 2013, at 16:29, DAVID HODGKINSON wrote:
>> On 21 May 2013, at 13:14, Philip Skinner <me at philip-skinner.co.uk>
>>> the src:
>> Upon sleeping on it, this was the direction I was headed in.
>> The problem is the HTML is user-generated and we know where that
> If I were using that approach, I'd host the HTML on a different domain
> (to use the Same Origin Policy to protect my site against JS attacks
> from the HTML) and cover it with anti-evil HTTP headers (to stop
> people including frame buster scripts).
> (Not that that would be the first approach I'd consider, I'd tend
> towards parsing the HTML, running it through a whitelist to determine
> what attributes were acceptable or not and then spitting out something
> valid and non-evil though.)
Plus remember to set a restrictive P3P policy on the domain/subdomain
hosting that stuff.
More information about the london.pm