How to sanitize HTML code in Java to prevent XSS attacks?

Question

I'm looking for class/util etc. to sanitize HTML code i.e. remove dangerous tags, attributes and values to avoid XSS and similar attacks.

I get html code from rich text editor (e.g. TinyMCE) but it can be send malicious way around, ommiting TinyMCE validation ("Data submitted form off-site").

Is there anything as simple to use as InputFilter in PHP? Perfect solution I can imagine works like that (assume sanitizer is encapsulated in HtmlSanitizer class):

String unsanitized = "...<...>...";           // some potentially                                                // dangerous html here on input  HtmlSanitizer sat = new HtmlSanitizer();      // sanitizer util class created  String sanitized = sat.sanitize(unsanitized); // voila - sanitized is safe... 

---

Update - the simpler solution, the better! Small util class with as little external dependencies on other libraries/frameworks as possible - would be best for me.

---

How about that?

Answer 1

You can try OWASP Java HTML Sanitizer. It is very simple to use.

PolicyFactory policy = new HtmlPolicyBuilder()     .allowElements("a")     .allowUrlProtocols("https")     .allowAttributes("href").onElements("a")     .requireRelNofollowOnLinks()     .build();  String safeHTML = policy.sanitize(untrustedHTML); 

Answer 2

You could use OWASP ESAPI for Java, which is a security library that is built to do such operations.

Not only does it have encoders for HTML, it also has encoders to perform JavaScript, CSS and URL encoding. Sample uses of ESAPI can be found in the XSS prevention cheatsheet published by OWASP.

You could use the OWASP AntiSamy project to define a site policy that states what is allowed in user-submitted content. The site policy can be later used to obtain "clean" HTML that is displayed back. You can find a sample TinyMCE policy file on the AntiSamy downloads page.