http://search.cpan.org/dist/HTML-Defang/lib/HTML/Defang.pm

HTML::Defang uses a custom html tag parser. The parser has been designed and tested to work with nasty real world html and to try and emulate as close as possible what browsers actually do with strange looking constructs. The test suite has been built based on examples from a range of sources such as http://ha.ckers.org/xss.html and http://imfo.ru/csstest/css_hacks/import.php to ensure that as many as possible XSS attack scenarios have been dealt with.

It’s worth checking those links to see how well your parser works. There’s some pretty nasty examples.

R0b

About one month ago I discovered the problem in the source code and fixed it, but it was cached by the server.

The JSP class is an utility class used by our framework, so the real sanitizer is slightly different from the published one where all JSP.xxx methods are on the same class (HtmlSanitizer).

Now the source code should be fine, see: http://patapage.com/applications/pataPage/site/test/HtmlSanitizer.html

Thanks you all for feedback,

Roberto

Truth be told, your code is the only usable stuff around the net regarding this topic,
and it looks quite impressive,
however i couldn’t find the class “JSP” (e.g. JSP.htmlEncodeApexesAndTags) you’re referencing several times in the code you linked above,

Would you be so kind to post that class as well?

Many thanks,
Regards,
Janos

Regards

Stewart