我最近一直在研究 Pagedown.js，因为它在我的页面上使用 mark-down 而不是丑陋的只读文本区域。

尽管我非常谨慎，因为欺骗经过 sanitizer 的转换器似乎很容易。我看过一些关于 Angular.js 及其 html 绑定(bind)的讨论，并且在 Knockout.js 3.0 发布时也听说过 html 绑定(bind)以前存在不安全问题。

似乎有人需要做的就是禁用 Pagedown.js 中的 sanitizer ，例如 -

var safeConverter = new Markdown.Converter();
// safeConverter is open to script injection

safeConverter = Markdown.getSanitizingConverter();
// safeConverter is now safe

// Override the getSanitizingConverter pseudo-code
Markdown.getSanitizingConverter = function () {
    return Markdown.Converter;
};

他们可以打开一个站点来进行脚本注入(inject)。这不是真的吗？

编辑

那为什么像这样的图书馆会打包 sanitizer 来使用客户端呢？当然，他们说不要渲染未净化的 html，但下一行说使用 Markdown.Sanitizer..

Angular 为何不通过 sanitizer 服务对其开放，或者这只是一场闹剧？

最佳答案

相信大家对这种“ sanitizer ”的用途和性质存在一点误解。

sanitizer (例如 Angular 的 ngSanitize)的目的是不防止“坏”数据被发送到服务器端。恰恰相反: sanitizer 可以保护非恶意用户免受恶意数据的侵害(要么是服务器端安全漏洞的结果(是的，没有完美的设置)或从其他来源(您无法控制的来源)获取)。

当然，作为客户端功能， sanitizer 可以被绕过，但是(因为 sanitizer 是用来保护用户(而不是服务器)的)绕过它只会让绕过者不 protected (你不能做任何事情，你也不应该关心 - 这是他们的选择)。

此外， sanitizer (可以)有另一个(可能更重要的) Angular 色: sanitizer 是一种工具，可以帮助开发人员更好地组织他们的代码，以便更容易测试某些类型的漏洞(例如 XSS 攻击) )，甚至有助于针对此类安全漏洞的实际代码审计。

在我看来， Angular docs 非常简洁地总结了这个概念:

Strict Contextual Escaping (SCE) is a mode in which AngularJS requires bindings in certain contexts to result in a value that is marked as safe to use for that context.
[...]
SCE assists in writing code in way that (a) is secure by default and (b) makes auditing for security vulnerabilities such as XSS, clickjacking, etc. a lot easier.

[...]
In a more realistic example, one may be rendering user comments, blog articles, etc. via bindings. (HTML is just one example of a context where rendering user controlled input creates security vulnerabilities.)

For the case of HTML, you might use a library, either on the client side, or on the server side, to sanitize unsafe HTML before binding to the value and rendering it in the document.

How would you ensure that every place that used these types of bindings was bound to a value that was sanitized by your library (or returned as safe for rendering by your server?) How can you ensure that you didn't accidentally delete the line that sanitized the value, or renamed some properties/fields and forgot to update the binding to the sanitized value?

To be secure by default, you want to ensure that any such bindings are disallowed unless you can determine that something explicitly says it's safe to use a value for binding in that context. You can then audit your code (a simple grep would do) to ensure that this is only done for those values that you can easily tell are safe - because they were received from your server, sanitized by your library, etc. You can organize your codebase to help with this - perhaps allowing only the files in a specific directory to do this. Ensuring that the internal API exposed by that code doesn't markup arbitrary values as safe then becomes a more manageable task.

<子> 注1:重点是我的。
注意 2: 抱歉引文冗长，但我认为这是一件非常重要(同样敏感)的事情，而且经常被误解。

关于javascript - 客户端 HTML 清理有多安全？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/23839173/