Now that html5 defines how to parse all html fragments there is really no reason not to use that algorithm.
Could you provide some working examples of using HTML 5 parser for input sanitization?
How to parse HTML
11–20 of 33 posts
Re: How to parse HTML
#12Now that html5 defines how to parse all html fragments there is really no reason not to use that algorithm.
Could you provide some working examples of using HTML 5 parser for input sanitization?
Re: How to parse HTML
#13For you python users, the BeautifulSoup module has a prettify module which does the same thing.
Re: How to parse HTML
#14Earlier quoted context omitted.
Could you provide some working examples of using HTML 5 parser for input sanitization?
http://code.google.com/p/html5lib/
I see that they mention sanitizer and give an example of how to call it, but I can't find any real-life code doing sanitization. Am I missing something? (I'm curious about the level of complexity such library would require in 'client' code.)
Re: How to parse HTML
#15Since this seems to be aimed (among other things) towards input sanitization, here is a semi-relevant entry that might amuse someone.
https://gist.github.com/1575452
This is a sanitizing HTML "parser" done in roughly 100 lines of PHP code. It does tag and attribute whitelisting, checks for protocols to prevent XSS, deals with unclosed and unopened tags, and does some other things. The biggest issue is that it's not well-factored. However, its shortness is appealing, because I understand how it works. I would have hard time trusting a library with thousands of lines of code to do input validation.
Re: How to parse HTML
#16Earlier quoted context omitted.
http://code.google.com/p/html5lib/
I see that they mention sanitizer and give an example of how to call it, but I can't find any real-life code doing sanitization. Am I missing something? (I'm curious about the level of complexity such library would require in 'client' code.)
Bleach [1] is a sanitizer that uses html5lib on the backend. I think that Mozilla use it.
Re: How to parse HTML
#17For you python users, the BeautifulSoup module has a prettify module which does the same thing.
Bleach[0] might be a better idea, it's based on html5lib
Re: How to parse HTML
#18This article should be called, "how to write a Marpa-based HTML parser", not "how to parse HTML". If you're a Perl programmer and want to parse HTML into an XML-style DOM, use XML::LibXML. If you can't handle the libxml2 dependency, use HTML::Parser.
Re: How to parse HTML
#19In the bad old days, parsing real-world HTML was a horrible task because every web-browser had a huge collection of undocumented corner-cases and hacks; some accidental, some the result of reverse-engineering other vendors' corner-cases and hacks. Most standalone HTML parsers could generate some document tree from a given input file; whether or not it would match the one generated by an actual browser was another mat…
Theres a Perl implementation in CPAN as well, though I haven't made nontrivial use of it, so I'm not sure how fast/robust it is: http://search.cpan.org/~tobyink/Task-HTML5-0.103/lib/Task/HT...
Re: How to parse HTML
#20The fact that browsers accept defective html is the most evil thing that happened to the web. Any library that tries to parse "real world" html just contributes to that evil. I am astonished that we tolerate this and still call ourselves (software) engineers.