Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/tgalopin/html-sanitizer
Sanitize untrustworthy HTML user input
https://github.com/tgalopin/html-sanitizer
Last synced: 14 days ago
JSON representation
Sanitize untrustworthy HTML user input
- Host: GitHub
- URL: https://github.com/tgalopin/html-sanitizer
- Owner: tgalopin
- License: mit
- Created: 2018-10-08T19:28:47.000Z (about 6 years ago)
- Default Branch: master
- Last Pushed: 2022-06-24T11:56:57.000Z (over 2 years ago)
- Last Synced: 2024-05-01T23:15:56.931Z (6 months ago)
- Language: PHP
- Homepage:
- Size: 261 KB
- Stars: 390
- Watchers: 17
- Forks: 43
- Open Issues: 24
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# html-sanitizer
> This library is deprecated as it was merged into Symfony as the HtmlSanitizer component in Symfony 6.1:
> https://symfony.com/doc/current/html_sanitizer.html
[](https://travis-ci.org/tgalopin/html-sanitizer)
[](https://packagist.org/packages/tgalopin/html-sanitizer)
[](https://github.com/tgalopin/html-sanitizer/blob/master/LICENSE)
[](https://insight.symfony.com/projects/befd5a5b-574c-4bea-9c4f-3ad202729a1b)
html-sanitizer is a library aiming at handling, cleaning and sanitizing HTML sent by external users
(who you cannot trust), allowing you to store it and display it safely. It has sensible defaults
to provide a great developer experience while still being entirely configurable.
Internally, the sanitizer has a deep understanding of HTML: it parses the input and create a tree of
DOMNode objects, which it uses to keep only the safe elements from the content. By using this
technique, it is safe (it works with a strict whitelist), fast and easily extensible.
It also provides useful features such as the possibility to transform images or iframes URLs to HTTPS.
## Symfony integration
This library is also available as [a Symfony bundle](https://github.com/tgalopin/html-sanitizer-bundle).
## Documentation
1. [Getting started](https://github.com/tgalopin/html-sanitizer/blob/master/docs/1-getting-started.md)
2. [Creating an extension to allow custom tags](https://github.com/tgalopin/html-sanitizer/blob/master/docs/2-creating-an-extension-to-allow-custom-tags.md)
3. [Configuration reference](https://github.com/tgalopin/html-sanitizer/blob/master/docs/3-configuration-reference.md)
4. [Comparison with HTMLPurifier](https://github.com/tgalopin/html-sanitizer/blob/master/docs/4-comparison-with-htmlpurifier.md)
## Security Issues
If you discover a security vulnerability within the sanitizer, please follow
[our disclosure procedure](https://github.com/tgalopin/html-sanitizer/blob/master/docs/A-security-disclosure-procedure.md).
## Backward Compatibility promise
This library follows the same Backward Compatibility promise as the Symfony framework:
[https://symfony.com/doc/current/contributing/code/bc.html](https://symfony.com/doc/current/contributing/code/bc.html)
> *Note*: many classes in this library are either marked `@final` or `@internal`.
> `@internal` classes are excluded from any Backward Compatiblity promise (you should not use them in your code)
> whereas `@final` classes can be used but should not be extended (use composition instead).
## Thanks
Many thanks to:
- [The Open Web Application Security Project](https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project)
from which many of the tests of this library are extracted (more specifically from
[OWASP/java-html-sanitizer](https://github.com/OWASP/java-html-sanitizer)) ;
- [Masterminds/html5-php](https://github.com/Masterminds/html5-php) which is a great HTML5 parser, used by default
in this library ;
- [The PHP League URI parser](http://uri.thephpleague.com/) which allows this library to filter hosts safely ;