Is using jquery parseHTML to remove script tags enough to prevent XSS attacks?

Question

We are using a WYSWIG Editor(Froala Editor) and storing raw HTML that is created by the user. Thus, escaping the string is not an option. I am intending to store the HTML string in a variable or a data-attribute enclosed within quotes. Then, read that HTML string and remove script tags using jquery's parseHTML as well as keep only certain attributes before loading the HTML into the editor. Is this approach enough to prevent all XSS attacks?

Answer 1

It is not. A few counter-examples:

• <a href="javascript:alert(1)">
• <div onclick="alert(1)">
• <img src="javascript:alert(1)"> (doesn't actually work anymore in modern browsers)
• <div style="background-image: url(javascript:alert(1))"> (doesn't work anymore)

Part of the difficulty is that it also depends on which browser the user is using. The bottomline is, you need a proper sanitizer, which can also be on the client-side. (It can also be on the server, but consider the "preview" feature of the editor if there is any - if previews are not sent to the server, a server-side sanitizer is not of much use. :) )

Google Caja is (was?) a html sanitizer project that also had a pure javascript component. There are other solutions as well.

Note that the editor javascript must support running its contents through a custom sanitizer before inserting it into the DOM if you want to do this in javascript.