What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

How does Stack Exchange sanitize the user's text to prevent XSS injections?

I've seen that if I write: (this is the doc about this bug)

> hello <a name="n"
> href="javascript:alert('xss')">*you*</a>

It sanitizes the output, even the preview.

Is it possible to know how it sanitizes the text for preventing this Markdown bug?

share|improve this question
2  
Isn't that explained in the article you linked? "So the conclusion is that, if you want real security, you need to filter Markdown’s output, not the input. There’s no other choice." So, I'd assume that's exactly what SE does. But you could peek into the code. –  Arjan Feb 16 '13 at 22:51
    
I wonder how it can sanitize the preview, the only way (according to my link) is to use Ajax call for sanitize the input, but I don't think it uses this solution.. –  Fez Vrasta Feb 16 '13 at 22:52
    
The preview is generated purely by JavaScript. It does not send it to the server to generate a preview then receive one back. –  animuson Feb 16 '13 at 23:13
    
Yes I was sure, so the javascript markdown parser know how to prevent this vulnerability, is the javascript version open source and downloadable? –  Fez Vrasta Feb 16 '13 at 23:25
    
Markdown.Sanitizer.js is part of Stack Exchange's open source markdown parser, PageDown. It's not an entirely general-purpose HTML sanitizer, it requires that users use a specific HTML subset. –  Jeremy Banks Feb 17 '13 at 0:44
    
Could you link me the page where I can download it please? –  Fez Vrasta Feb 17 '13 at 1:38
    
@FezVrasta code.google.com/p/pagedown –  Yannis Feb 17 '13 at 9:21
    
Thank you. Solved :) –  Fez Vrasta Feb 17 '13 at 9:38

You must log in to answer this question.

Browse other questions tagged .