Java：从HTML中删除Javascript的最佳方法 [英] Java: Best way to remove Javascript from HTML
问题描述
从HTML中删除将要显示的Javascript的最佳库/方法是什么？
What's the best library/approach for removing Javascript from HTML that will be displayed?
例如，取：
<html><body><span onmousemove='doBadXss()'>test</span></body></html>
并离开：
<html><body><span>test</span></body></html>
我看到 DeXSS 项目。但这是最好的方法吗？
I see the DeXSS project. But is that the best way to go?
推荐答案
JSoup有一种基于白名单清理HTML的简单方法。
查看 http://jsoup.org/cookbook/cleaning-html/whitelist-消毒剂
JSoup has a simple method for sanitizing HTML based on a whitelist. Check http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer
它使用白名单，这比DeXSS使用的黑名单方法更安全。来自DeXSS页面：
It uses a whitelist, which is safer then the blacklist approach DeXSS uses. From the DeXSS page:
DeXSS尚未检测到许多已知的XSS攻击。
There are still a number of known XSS attacks that DeXSS does not yet detect.
黑名单只允许已知的不安全结构，而白名单只允许已知的安全结构。如此未知，可能不安全的结构只会受到白名单的保护。
A blacklist only disallows known unsafe constructions, while a whitelist only allows known safe constructions. So unknown, possibly unsafe constructions will only be protected against with a whitelist.
这篇关于Java：从HTML中删除Javascript的最佳方法的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
