为什么使用白名单进行HTML消毒？ [英] Why use a whitelist for HTML sanitizing?

问题描述

我经常想知道 - 为什么在清理HTML输入时使用白名单而不是黑名单？

有多少偷偷摸摸的HTML技巧可以打开XSS漏洞？很明显脚本标记和框架是不允许的，并且在HTML元素的字段中会使用白名单，但是为什么不允许大部分内容？ 解决方案

如果您从白名单中删除某些内容，那么您只需要分解一些不够重要的内容，以便您首先考虑。

如果您

如果浏览器添加了新功能，那么您的黑名单就会过期。

I've often wondered -- why use a whitelist as opposed to a blacklist when sanitizing HTML input?

How many sneaky HTML tricks are there to open XSS vulnerabilities? Obviously script tags and frames are not allowed, and a whitelist would be used on the fields in HTML elements, but why disallow most of everything?

解决方案

If you leave something off a whitelist, then you just break something that wasn't important enough for you to think about in the first place.

If you leave something off a blacklist, then you've opened a big security hole.

If browsers add new features, then your blacklist becomes out of date.

这篇关于为什么使用白名单进行HTML消毒？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！