Filter JS From HTML

概要

Provides specialized guidance for removing JavaScript from HTML to prevent Cross-Site Scripting (XSS) while maintaining high-fidelity document structure. It covers the identification of diverse injection vectors—including script tags, event handlers, and dangerous URL schemes—and offers strategies for using robust parsers to handle malformed HTML. The skill emphasizes format preservation, ensuring that whitespace, entity encoding, and quote styles remain untouched during the transformation, making it essential for building secure sanitization tools and processing user-generated content.

主な機能

• Guidance on parser selection and configuration for Python environments using tools like lxml and BeautifulSoup.
• 16 GitHub stars
• Identification of comprehensive XSS vectors across script elements, event handlers, and URL schemes.
• Defense-in-depth implementation strategies using normalization and allowlist-based filtering.
• Format-preserving transformation techniques for maintaining whitespace and entity encoding.
• Rigorous verification checklists for testing against bypass techniques and malformed HTML.

ユースケース

• Building secure HTML sanitizers for processing and displaying user-generated content.
• Sanitizing web-scraped data to remove tracking scripts and interactive elements before storage.
• Hardening legacy web templates by stripping legacy JavaScript and event handlers.