HTML Purifier: Standard cross-site scripting prevention library

HTML Purifier: Standard cross-site scripting prevention library

Login or register to post comments

6 replies [Last post]

Fri, 03/13/2009 - 06:53

alex94040

Offline

Joined: 11/06/2008

Folks,

QCubed includes a bunch of hacky code for cross-site scripting prevention. I think we should switch over to a standard library to do this work: HTML Purifier looks promising (http://htmlpurifier.org/). What do you think?

Thanks!

Fri, 03/13/2009 - 10:31

#1

rtacconi

Offline

Joined: 07/07/2008

I seems to be an interesting project and the license is LGPL, so quite compatible with the MIT of QCubed.

Unfortunately I am not so good in this field, but I like your proposal.

Fri, 03/13/2009 - 16:53

#2

VexedPanda

Offline

Joined: 03/31/2008

I'm semi-wary about including LGPL in core, but a separate download for it shouldn't be an issue.
As such I'd be all for tearing out the existing input validation code and requiring those who want validation to use HTML Purifier exclusively. It has been my choice of validation classes for some time.

Tue, 03/17/2009 - 07:19

#3

OOPMan

Offline

Joined: 11/07/2008

Thanks for posting this Alex as I was completely unaware of it's existence. I will definitely be pushing the usage of this at my work and I think I may also try to do some integration work on it :-)

Thu, 06/04/2009 - 01:44

#4

Jandal

Offline

Joined: 04/23/2008

You have my vote for HTML Purifier!

=-)

Thu, 06/04/2009 - 10:23

#5

voyager123bg

Offline

Joined: 03/06/2009

HTML purifier seems really nice, I'd be happy to see it integrated with Qcubed.

Tue, 02/07/2012 - 14:04

#6

Vaibhav

Offline

Joined: 10/11/2010

I think the licensing issue just came up again :P

If someone can help, please tell us if LGPL and MIT licenses are compatible.