DOMPurify VS HtmlSanitizer

Let's take a look at how we implement sanitization in the secure version of our vulnerable application. Since this application is primarily written using JavaScript, we use the dompurify library for the client side and the isomorphic-dompurify library for server-side sanitization. In the app.js program that acts as our web server, you will find an express endpoint /sanitized with a GET and POST implementation:

After several hours of code review, I finally spotted something unfamiliar in the Markdown Renderer component: a function called escapeHTML was being used to escape HTML, even though DOMPurify was already being used for sanitization right after!

DOMPurify Documentation

Use libraries such as DOMPurify to sanitize input.

//https://github.com/cure53/DOMPurify import React from "react"; import DOMPurify from "dompurify"; const sanitize = (dirty) => DOMPurify.sanitize(dirty); const DangerousHtml = ({ innerHTML, tag }) => { const clean = sanitize(innerHTML); if (typeof tag === "undefined") { return

; } return ; }; export default DangerousHtml;

Input Sanitization: The most crucial step in preventing XSS attacks is to ensure that all user-generated content is properly sanitized before it is rendered on the page. Use libraries like DOMPurify or built-in sanitization functions provided by your framework (e.g., React's dangerouslySetInnerHTML) to strip out any potentially harmful code.

When using dangerouslySetInnerHTML, it is crucial to sanitize the HTML strings to prevent XSS attacks. DOMPurify is a robust library that cleans HTML content by removing or neutralizing potentially dangerous scripts or tags.

Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors.

Some libraries for doing that with good defaults:

- https://github.com/cure53/DOMPurify

- https://github.com/apostrophecms/sanitize-html

- https://github.com/bevacqua/insane

(right now your site looks vulnerable to XSS)

DOMPurify

React seems to automatically handle HTML Encoding of variables to prevent XSS. With that said, should I take further steps to sanitize the inputs on the Api? Using something like the HtmlSanitizer - https://github.com/mganss/HtmlSanitizer?

i'm at a bit of a loose end. i recently installed Html Sanitizer to my old asp.net webforms "website" project, and while my build server builds the project successfully with msbuild, i get 500 errors saying there's binaries missing, and low and behold two dlls aren't getting copied to bin folder from the packages directory but it works perfectly fine when i do a build in visual studio (clean and rebuild is fine as well) and i have no idea why this is happening and need some help.