It unescapes HTML entities

[mitchellevan]

Current behavior

The input contains an ampersand as an HTML entity.

<button>Apples &amp; Oranges</button>

In the output, the ampersand is changed to a single character. Probably because that's what <textarea> does.

<button>Apples & Oranges</button>

Expected behavior

The HTML entity should be unchanged.

[OwenEdwards]

@mitchellevan I think this probably happens because de-crapulator inserts the actual HTML into the DOM (https://github.com/lloydi/markup-de-crapulator/blob/main/Source/de-crapulator.js#L56), and then processes attributes and classes there, before extracting it back out of the DOM (https://github.com/lloydi/markup-de-crapulator/blob/main/Source/de-crapulator.js#L130). So it's the browser that unescapes HTML entities in text as they are inserted into the DOM.

Inserting the HTML into the DOM seems like it has a lot of security implications, so fixing this issue may be a side-effect of a major change to fix those security issues.

[lloydi]

Inserting the HTML into the DOM seems like it has a lot of security implications, so fixing this issue may be a side-effect of a major change to fix those security issues.

Yeah, I originally did this as a bunch of string replacements for everything but on the basis that 1) I suck at Regex and 2) walking the DOM to manipulate attributes seems the more sensible and robust way to do this, I opted for that approach of injecting the textarea content into a hidden node and walking through that. I didn't consider that this would/could have any security implications (in all honesty, this was all borne out of personal frustration at having to try to remediate garbage markup as part of the day job, and security didn't cross my mind).

I'm really not sure what I would have to do to address security issues given that I don't understand the implications.

[OwenEdwards]

@lloydi I definitely understand why you created this tool, and I'm interested in using it for exactly the same purpose; this feedback is intended to help make it better, not to simply ciritcize what you've done. Please don't take it that way!

So, here's an example of how someone could send someone a link that injects Javascript into your page (notice that the link that is displayed isn't the same as the one that's actually followed):

https://lloydi.com/a11y-tools/markup-de-crapulator/index.html?markup=Fluffy+kittens

If it's only you using the page, that may not seem like an issue, but if someone other than you uses your page (and the page is available to the whole Internet, right?), they could do something much more malicious. See:

• https://en.wikipedia.org/wiki/Code_injection
• https://en.wikipedia.org/wiki/Cross-site_scripting
• https://owasp.org/www-community/attacks/xss/