note 89453 modified in function.strip-tags by danbrown

Improperly formatted javascript being add to tags and the limit of 15 instences of recursion before memory allocation runs out are some of the concerns involved in coding. Here is the code that I created to leave tags intact but strip scripting from only inside the tags... <?php function strip_javascript($filter){ // realign javascript href to onclick $filter = preg_replace("/href=(['\"]).*?javascript:(.*)? \\1/i", "onclick=' $2 '", $filter); //remove javascript from tags while( preg_match("/<(.*)?javascript.*?\(.*?((?>[^()]+) |(?R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?javascript.*?\(.*?((?> [^()]+)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // dump expressions from contibuted content if(0) $filter = preg_replace("/:expression\(.*?((?>[^ (.*?)]+)|(?R)).*?\)\)/i", "", $filter); while( preg_match("/<(.*)?:expr.*?\(.*?((?>[^()]+)|(? R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?:expr.*?\(.*?((?>[^()] +)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // remove all on* events while( preg_match("/<(.*)?\s?on.+?=?\s?.+?(['\"]).*?\\2 \s?(.*)?>/i", $filter) ) $filter = preg_replace("/<(.*)?\s?on.+?=?\s?.+? (['\"]).*?\\2\s?(.*)?>/i", "<$1$3>", $filter); return $filter; } ?> As you can see this does not clean up correctly... it does however remove dangerous stuff... <a href=javascript: { {({}{}()())}alert('xss') ) ) }> <div onload..;,;..'alert(\"xss_attack\");'> <a href='javascript:{ alert(\"xss_attack\"); otherxss();}' onclick= 'alert(\"xss_attack\");' onhover='alert (\"xss_attack\");' onmouseout=alert(\"xss_attack\") class='thisclass'> link</a> style='width:expression(alert(\"xss_attack\"));' This can be completed before using strip_tags(). --was-- Thanks for posting your scripts, I have been able figure out some intersting things: I still have concerns about improperly formatted javascript being add to tags. The regex tools are helpful.. but may not be able to be used how I was expecting. There are some concerns about the limit of 15 instences of recursion before memory alocation run out. Here is the code that I created to leave tags intact but strip scripting from only inside the tags... function strip_javascript($filter){ // realign javascript href to onclick $filter = preg_replace("/href=(['\"]).*?javascript:(.*)? \\1/i", "onclick=' $2 '", $filter); //remove javascript from tags while( preg_match("/<(.*)?javascript.*?\(.*?((?>[^()]+) |(?R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?javascript.*?\(.*?((?> [^()]+)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // dump expressions from contibuted content if(0) $filter = preg_replace("/:expression\(.*?((?>[^ (.*?)]+)|(?R)).*?\)\)/i", "", $filter); while( preg_match("/<(.*)?:expr.*?\(.*?((?>[^()]+)|(? R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?:expr.*?\(.*?((?>[^()] +)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // remove all on* events while( preg_match("/<(.*)?\s?on.+?=?\s?.+?(['\"]).*?\\2 \s?(.*)?>/i", $filter) ) $filter = preg_replace("/<(.*)?\s?on.+?=?\s?.+? (['\"]).*?\\2\s?(.*)?>/i", "<$1$3>", $filter); return $filter; } As you can see this does not clean up correctly... it does however remove dangerous stuff... <a href=javascript: { {({}{}()())}alert('xss') ) ) }> <div onload..;,;..'alert(\"xss_attack\");'> <a href='javascript:{ alert(\"xss_attack\"); otherxss();}' onclick= 'alert(\"xss_attack\");' onhover='alert (\"xss_attack\");' onmouseout=alert(\"xss_attack\") class='thisclass'> link</a> style='width:expression(alert(\"xss_attack\"));' This can be completed before using strip_tags(). http://php.net/manual/en/function.strip-tags.php