8

I'm looking for a simple list of all the html attributes that can contain javascript that will automatically run when an action is performed. I know this will differ between browsers and versions but I'd rather be safer than sorry. I currently know of the following javascript attributes: onload, onclick, onchange, onmouseover, onmouseout, onmousedown, and onmouseup

Backstory: I'm getting a full html document from an untrusted source and I want to strip all javascript that could run from the original html document so I'm removing all script tags as well as any attributes that could hold javascript before its displayed in an iframe. For this implantation there is no server side processing and no way of sandboxing the code since I need to run javascript that is being added locally after all of the original javascript is removed.

2
  • Found some useful info and checks at html5sec.org
    – Scott
    Commented Jan 11, 2015 at 23:28
  • You probably should just use a thoroughly tested HTML sanitizer library.
    – mb21
    Commented Oct 20, 2018 at 10:03

2 Answers 2

16

There are two places where Javascript can be used in HTML attributes:

  1. Any onEVENT attribute. I suggest just treating any attribute that begins with on as an event binding, and strip them all out.

  2. Any attribute that can contain a URI will be executed as Javascript if the URI uses the javascript: scheme, such as href and src. A complete list is in

COMPLETE list of HTML tag attributes which have a URL value?

8
  • I hadn't though about validating the URI attributes, do you know any good way of doing it in Javascript?
    – Scott
    Commented Jan 9, 2015 at 11:44
  • 2
    Just check whether the value of the attribute begins with javascript:.
    – Barmar
    Commented Jan 9, 2015 at 16:11
  • Thanks, think I'm still missing some attack vectors in css but its a good start.
    – Scott
    Commented Jan 10, 2015 at 18:30
  • I think the only place it could appear in CSS would be styles that allow url(...) values. So look for url(javascript:...).
    – Barmar
    Commented Jan 10, 2015 at 18:54
  • Its a bit more complicated owasp.org/index.php/… But my main problem is how to validate external css files.
    – Scott
    Commented Jan 11, 2015 at 23:19
2

http://www.w3.org/TR/html401/interact/scripts.html#h-18.2.3

Scroll down to 18.2.3 Intrinsic events

I've had a similar requirement in a project. Don't forget to strip script elements, as well.

3
  • 2
    That doesn't include href="javascript:..." and src="javascript:..."
    – Barmar
    Commented Jan 9, 2015 at 1:25
  • I though there should be a simple list somewhere but I couldn't find it. Thanks for the link.
    – Scott
    Commented Jan 9, 2015 at 11:44
  • 1
    Use this as well: w3.org/TR/html52/…. Otherwise you're going to miss a lot global event handlers.
    – DylanYoung
    Commented Jun 26, 2020 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.