CS XSS Prevention update rule 6 JS/Node lib(s)

[rdela]

• What update/refactoring do you want to perform?

Update JS/Node lib(s) on Cross Site Scripting Prevention rule 6.

Cross Site Scripting Prevention rule 6 links to ecto/bleach under "Other libraries that provide HTML Sanitization include: [...] JavaScript/Node.js Bleach" (Line 344).

The current (5 year-old) version, [email protected], contains 1 moderate severity vulnerability according to https://npmjs.com/advisories/47

Overview

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.

Remediation

The bleach package is not currently maintained, and has not seen an update since 2014.

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality.

The advisory then links to a fairly unhelpful search for "html sanitizer" on npmjs.com.

There is an open issue from 2016 at ecto/bleach#12.

My cursory research into currently maintained libraries yielded two options:

1. cure53/DOMPurify, a DOM-only library that requires JSDOM on Node.js
2. punkave/sanitize-html, a Node.js-only library that depends on htmlparser2

If OWASP contributors find both libraries adequate and satisfactory, my suggestion for the revision would be to split "JavaScript/Node.js Bleach" (Line 344) into two lines/list items like so:

• JavaScript (DOM-only, requires JSDOM for Node.js)
• Node.js (depends on htmlparser2)

If desired, I am willing to open a PR for the above suggested revision or whatever contributors advise. Thoughts?

[jmanico]

👍🏼👍🏼 Excellent find here. Thank you! Jim Manico @manicode Secure Coding Education +1 (808) 652-3805

[righettod]

Thank you very much for your proposal that is totally right. Please, go ahead with your PR and ping us if you need help 😃

[rdela]

Linked to PR #103 XSS CS Update

[mackowski]

One more time thank you for your contribution 👍