Hacker News Reader

> DOMPurify’s job is to take an untrusted HTML snippet, supposedly coming from an end-user, and remove all elements and attributes that can lead to Cross-Site Scripting

The error here is to use a blacklist instead of a whitelist.

View on HN

If you read the article, you will find that DOMPurify uses a whitelist, that DOMPurify’s model thinks the offending snippet is safe, that nothing in particular is wrong with the model per se, and that the bug is something else entirely.

I disagree, dompurify takes a blacklist approach of trying to remove evil instead of only allowing through application-specific sane things (that it uses whitelists is a separate thing)

You need defaults, and that default is an allow-list of sane HTML. If you want, you can initialize DOMPurify with your own allow-list, that might just be the bold, italics, underline, strikethrough.

The fact that their list is not namespace-specific is a bigger issue imo.

Reply on news.ycombinator.com