content VS java-html-sanitizer

MDN Web Docs content

In this article, we've covered the basics of character encoding in JavaScript, including the different encoding standards, how they work, and how to work with them in Node.js and web browsers. We've also covered some best practices for working with character encoding in JavaScript and provided tips and techniques for debugging encoding issues. If you want to learn more about character encoding in JavaScript, there are several resources. The Unicode Consortium's website provides detailed information about the Unicode standard, while the Mozilla Developer Network has extensive documentation on character encoding in JavaScript. Additionally, there are several books on JavaScript that cover this topic in depth, such as "JavaScript: The Definitive Guide" by David Flanagan and "Eloquent JavaScript" by Marijn Haverbeke.

Great job! You've learned all about gradients and now you can use them like a CSS expert. With these skills, you can make your websites more colorful and attractive. you can read more in MDN website.

(https://developer.mozilla.org/) MDN Web Docs is the go-to resource for comprehensive documentation on JavaScript. From beginner tutorials to advanced references, it covers everything you need to know about JavaScript, including syntax, methods, and APIs.

(https://developer.mozilla.org/) This is your official guide to all things web development, straight from the team behind the popular Firefox browser. MDN boasts comprehensive documentation on HTML, CSS, JavaScript, and web APIs, making it an invaluable reference for developers of all levels.

MDN Web Docs, previously Mozilla Developer Network

MDN Web Docs MDN Web Docs is an invaluable resource for web developers. From basic syntax to advanced concepts, you'll find comprehensive documentation on HTML, CSS, JavaScript, and more.

Nonce attribute from MDN

MDN Web Docs (Visit Site)

In Symbiote.js, almost everything you see should already be familiar to you, directly or indirectly. Unless you're new to frontend. And if you are a beginner, then you can learn the necessary basics on popular sites with documentation on modern specifications, for example MDN.

Is there any reason not to use OWASP Html Sanitizer for this use case?

My thoughts as a maintainer of a HTML sanitizer https://github.com/microcosm-cc/bluemonday

1. Sanitizing is not difficult, defining the policy/config is difficult as your need is not someone else's. First glance of this proposal is that this needs a lot more work to cover people's needs. It's good enough, but will have a lot of edges and will need to evolve.

2. If you allow a blocklist then people will use that by default as it's easier to say "I don't want " than it is to say "I only accept 3. Even if you sanitize something you should keep the raw input... you should store the raw input alongside the sanitized (in fact the sanitized is merely a cached version of the raw input having been sanitized). The reason for this is you will have issues you need to debug (and can't without the input) and you will have round-trip edits you should support (but it's not round-trippable when everything you return is different from the input, do not punish a user who pasted HTML thinking it was safe by then not allowing them to edit it out because you threw everything away). Additionally if you want to ever report on the input, i.e. topK values, and you've modified the input and not kept raw, then you can never do this.

4. Provide a sane default. Most engineers simply do not know what is safe or not. I ship a policy in bluemonday for user generated content... it is safe by default and good enough for most people, and it can be taken and extended due to the way the API is structured so can cover other scenarios as a foundation policy.

I think the proposal in general: specify a standard for a sanitization API has merit. But mostly it has merit if it specifies a standard for defining sanitization policies/configuration, allowing them to be portable across different languages and systems.

The one I wrote is very heavily inspired by https://github.com/owasp/java-html-sanitizer which is the OWASP project one maintained by Mike Samuel. When I did my research before writing the Go one, this was far and away the best way to construct the policy/config and I already saw that this perspective was more valuable than whether it's a token based parser (GIGO but low memory) or a DOM builder (more memory)... no-one cares about the internals, they care about expressing what safe means to them.