Breadcrumbs

HTML Sanitization Database Layer

Introduction

As the HTML sanitization of user input can be turned and kept off by administrators unintentionally, or malicious text can be saved in the database by using the LMS API, there is an extra layer for automatically cleaning unsafe text before it is stored in the database. This protects you and your users from Cross-Site Scripting (XSS) attacks, where malicious scripts hidden in content run in a reader's browser.

Cleaning keeps safe formatting such as headings, paragraphs, lists, links, images and tables. It removes anything that could run code, such as scripts and embedded frames. Because of this, saved content can occasionally look slightly different from what you entered.

How it works

Content is cleaned at the last step before it is saved to the database, no matter how it arrives. This applies equally to content entered in the user interface, sent through the REST API, delivered through message queues, or loaded in batch imports.

Cleaning is based on OWASP AntiSamy, an established open-source security library. It compares your HTML against a list of approved tags and attributes. Anything not on the list is removed, while your text and safe formatting are kept.

This works as an extra layer of protection. Even if unsafe content gets past other checks, it never reaches stored data.

What happens to your text containing HTML

Each HTML tag is handled in one of four ways. The reference below shows which applies to each tag.

Behavior

What happens

Example input

Stored result

Keep

The tag and its content are kept. Attributes not on the approved list are dropped.

<p onclick="x()">Hello</p>

<p>Hello</p>

Empty

The tag is kept, but everything inside it is removed.

<dt>Term</dt>

<dt></dt>

Remove

The tag and everything inside it are removed completely.

<script>alert(1)</script>

(nothing)

Links are only kept when they use the http or https protocol. Links using other protocols, such as javascript:, are removed.

Supported HTML reference

The following attributes are allowed on every supported tag: id, style, title, class, align and lang. The table lists any additional attributes a tag accepts.

Category

Tag

Behavior

Additional attributes

Headings

<h1> to <h6>

Kept

—

Text blocks

<p>

Kept

align

Text blocks

<div>

Kept

align

Text blocks

<section>

Kept

id, style, class

Text blocks

<blockquote>, <pre>, <address>, <center>

Kept

—

Text blocks

<br>, <hr>

Kept

—

Text formatting

<b>, <strong>, <i>, <em>, <u>, <s>, <strike>

Kept

—

Text formatting

<small>, <big>, <sub>, <sup>, <span>

Kept

—

Text formatting

<code>, <samp>, <cite>

Kept

—

Text formatting

<font>

Kept

color, face, size

Edits

<ins>, <del>

Kept

cite, datetime

Links

<a>

Kept

href, wref, onFocus, onBlur, target, nohref, rel, name

Images

<img>

Kept

src, name, alt, height, width, border, align, hspace, vspace

Images

<map>

Kept

—

Lists

<ul>, <li>

Kept

—

Lists

<ol>

Kept

type

Lists

<dl>, <dt>, <dd>

Emptied

—

Tables

<table>

Kept

height, width, border, bgcolor, cellpadding, cellspacing, background, align, noresize

Tables

<thead>, <tbody>, <tfoot>

Kept

align, char, charoff, valign

Tables

<tr>

Kept

height, width, align, valign, char, charoff, background

Tables

<th>

Kept

abbr, axis, headers, scope, nowrap, bgcolor, height, width, align, char, charoff, valign, colspan, rowspan

Tables

<td>

Kept

background, bgcolor, abbr, axis, headers, scope, nowrap, height, width, align, char, charoff, valign, colspan, rowspan

Tables

<colgroup>

Kept

span, width, align, char, charoff, valign

Tables

<col>

Kept

span, width, align, char, charoff, valign

Tables

<caption>

Kept

—

Forms

<fieldset>, <legend>

Kept

—

Forms

<label>

Kept

for

Styling

<style>

Kept

type, media

Styling

<link>

Kept

media, type, rel

Other

<noscript>

Kept

—

Removed elements

The following are always removed completely, including everything inside them:

  • <script>

  • <iframe>

  • <frameset> and <frame>

Event attributes such as onload and onerror are also removed, as are styles that could change the layout of the surrounding page.

Configuration

Sanitization is turned on by default. It is controlled by a single setting in the file ils/application.properties:

ils.database.sanitize=true

To turn sanitization off, set the value to false and restart the application. This setting is currently the only way to change this behavior.

Turning sanitization off removes an important protection against XSS attacks. Only do this if your content is fully trusted or is cleaned by another system before it is saved.

Tips and FAQ

Why does my saved content look different from what I entered? A tag or attribute you used is not on the approved list and was removed. Check the reference table above and use a supported alternative.

My definition list lost its text. Why? <dl>, <dt> and <dd> are kept but emptied. Use a <ul> list or a two-column <table> instead.

Why was my link removed? Only http and https links are kept. Make sure each link starts with one of these.

Can I embed videos or other pages? No. <iframe> and frame tags are always removed. Link to the content with <a> instead.

Does this apply to content imported through the API? Yes. All content is cleaned before it is saved, whatever its source.