Demo Output Confusing about dompurify

[cure53]

Heya,

I understand what you mean. Currently, the demo is basically a large bunch of test vectors that we simply write to the DOM to show that no dangerous HTML slips through. So the huge red letters are in fact expected behavior :)

What would you suggest to make it better? One thing I could imagine would be less HTML and annotations explaining what happens. We could do that as soon as we have a test-suite running (cc @fhemberger ). Right now the demo is a quasi test-suite. That is of course not ideal.

Do you have any specific suggestions of how to make the demo be more intuitive and friendly?

[Miserlou]

I think explaining what's actually happening during the test is very useful, as is having an example or description of the expected behaviour.

(Also, as an aside, if Style tags are allowed, how does it handle remote includes in styles? https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#STYLE_sheet)

[cure53]

Makes sense. I'll tidy up the demo once we have a test-suite. Thanks for raining this issue!

[cure53]

I have added some extra text to explain what happens. I also changed the jQuery stress-test to use html() instead of the factory. A quick look at the wording and maybe a pull request in case the wording is still confusion would be appreciated ;) I am not a great texter and it wasn't confusing to me before - so not sure if my change hit the target.

About your question on CSS and remote styles: The info given in the OWASP "cheatsheet" is hopelessly outdated. It is not possible to cause XSS using CSS on modern browsers (as far as I know). There's a whole bunch of UI attacks and what not but we don't consider them in scope for the DOMPurify default values. Anyone can however simply remove <style> from the list of permitted elements to be 101% safe and secure.

[Miserlou]

Looks great to me!