Java XSS Sanitization for nested HTML elements

Question

I am using JSoup library in Java to sanitize input to prevent XSS attacks. It works well for simple inputs like alert('vulnerable').

Example:

String data = "<script>alert('vulnerable')</script>";
data = Jsoup.clean(data, , Whitelist.none());
data = StringEscapeUtils.unescapeHtml4(data); //StringEscapeUtils from apache-commons lib
System.out.println(data);

Output: ""

However, if I tweak the input to the following, JSoup cannot sanitize the input.

String data = "<<b>script>alert('vulnerable');<</b>/script>";
data = Jsoup.clean(data, , Whitelist.none());
data = StringEscapeUtils.unescapeHtml4(data);
System.out.println(data);

Output: <script>alert('vulnerable');</script>

This output obviously still prone to XSS attacks. Is there a way to fully sanitize the input so that all HTML tags is removed from input?

I mean, you realize, that your second example differs from the first only be leaving out the <SCRIPT> tag in the String ... This doesn't actually have a <SCRIPT> element in it: <<b>script>alert('vulnerable');<</b>/script> ... This is malformed HTML. What are you expecting? Furthermore, I have never quite understood the purpose of JSoup's XSS attack cleaners. If you wish to simply eliminate <SCRIPT> tags, then just remove them... — Y2020-09
– Y2020-09, Commented Oct 4, 2020 at 12:53

1218985 · Accepted Answer · 2020-10-04 01:05:43Z

2

Not sure if this is the best solution, but a temporary workaround would be parsing the raw text into a Doc and then clean the combined text of the Doc element and all its children:

String unsafe = "<<b>script>alert('vulnerable');<</b>/script>";
Document doc = Jsoup.parse(unsafe);
String safe = Jsoup.clean(doc.text(), Whitelist.none());
System.out.println(safe);

Wait for someone else to come up with the best solution.

answered Oct 4, 2020 at 1:05

1218985

8,1122 gold badges29 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Nitin Mathur Over a year ago

Thank you @1218985. Tried your solution. So far this solution looks good as it fulfills what I need.

Jonathan Hedley · Accepted Answer · 2022-06-13 13:23:56Z

0

The problem is that you are unescaping the safe HTML that jsoup has made. The output of the Cleaner is HTML. The none safelist passes no tags, only the textnodes, as HTML.

So the input:

<<b>script>alert('vulnerable');<</b>/script>

Through the Cleaner returns:

&lt;script&gt;alert('vulnerable');&lt;/script&gt;

which is perfectly safe for presenting as HTML. See https://try.jsoup.org/~hfn2nvIglfl099_dVxLQEPxekqg

Just don't include the unescape line.

answered Jun 13, 2022 at 13:23

Jonathan Hedley

10.5k3 gold badges39 silver badges49 bronze badges

Collectives™ on Stack Overflow

Java XSS Sanitization for nested HTML elements

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related