Autosanitization
Component ID
1738212
Component name
Autosanitization
Component type
module
Maintenance status
Development status
Component security advisory coverage
not-covered
Component created
Component changed
Component body
Autosanitization
(The module has namespace "sr"=secure rendering for historic reasons)
For backgrouds see
- Presentation proposal: Autosanitization | DrupalCon Munich 2012
- Background paper: www.cs.berkeley.edu/~prateeks/papers/empirical-webfwks.pdf
Short description: Proper autosanitization must be
* context-stack-aware
* and mimic appropriate browser decoding
this is possible if
* we have a system to classify html context
* for each html context we have a class that knows how to sanitize, decode and encode
* for each template variable we (explicitly or implicitly) know its html context
* we do late rendering, when we know the whole context stack
This module contains a proof of concept for this.