How to remove Inner HTML from parsed HTML with DOMDocument?

Question

I have to process user-provided markup for a specific kind of embed, which is typically in the form of a <script> tag, typically with a src attribute. There are a variety of different <script> components that can be used here, each one different. However, to avoid potential XSS attacks, we've deemed it necessary to strip out anything inside the tag.

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js">document.write("vinny say something funny"); //This should be sanitized out</script>

DOMDocument really doesn't give us an easy way to alter the innerhtml, and I have seen a few approaches but none seem to address keeping attribute intact if the tag is destroyed. Am I missing something in implementing a best approach, or is there an easier way to go about addressing this?

Sean Bright · Answer 1 · 2019-07-10T19:03:04.287

This code removes child nodes from the <script> node. In this case it's the document element:

<?php
$xml = '<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js">document.write("vinny say something funny");</script>';                               

$doc = new DOMDocument();
$doc->loadXml($xml);

$scriptNode = $doc->documentElement;

while ($scriptNode->hasChildNodes()) {
    $scriptNode->removeChild($scriptNode->lastChild);
}

echo $doc->saveXML();

Output is:

<?xml version="1.0"?>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"/>

score 0 · Answer 2 · answered Jul 10 '19 at 19:03

As a simple method is to do a shallow clone of the node (using cloneNode()) without the optional parameter.

This will go through the loaded document and replace each script node with the new content...

$html = '<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js">document.write("vinny say something funny");</script>';

$doc = new DOMDocument();
$doc->loadHTML($html);

foreach ( $doc->getElementsByTagName("script") as $script ){
    $script->parentNode->replaceChild($script->cloneNode(), $script);
}
echo $doc->saveHTML();

gives...

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><head><script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script></head></html>

How to remove Inner HTML from parsed HTML with DOMDocument?

2 Answers2