Disabling javascript in specific block/div (containing suspect HTML)?

Question

Is it, in any way, possible to disable the browsers execution of script inside a block/section/element ?

My scenario is, that I'm letting my (future) users create "rich content" (using CK-editor). Content that wil later be shown to other users - with all the dangers that imply: xss, redirection, identity theft, spam and what not...

I've, more or less, given up on trying to "sanitize" the incomming XHTML, after seeing how many known "vectors of attack" there are: http://ha.ckers.org/xss.html

What I'm really looking for is something like:

< div id="userContent">< scriptOFF>

suspect HTML

< /scriptOFF>< /div>

Answer 1

The ideal way is to not accept html/javascript from the end users. If you are okay with that limitation, you just need to make sure you encode the output according to the appropriate context. Don't re-invent the wheel, just use an existing library for that purpose.

But if you must accept HTML, use a library like OWASP's ANTI-SAMY or HTML Purifier. They were built exactly for this purpose.

Answer 2

You have to sanitize the input, there is no way to selectively disable javascript that I know of.

It is important to use a whitelist of allowed tags, not a blacklist. That way it should be possible to do it safely.