Sanitize function too sanitary?

Question

I'm working on a webapp that sanitizes models for the view. However, it is stripping too many wanted characters, like forward slashes, semi-colons, colons, dollar signs, quote marks and accented letters from foreign languages. e.g. 3/8"W becomes 38w.

Do I need to modify the function to be less aggressive, or should I simply not use the sanitize function at all? I guess the bigger question is, what is sanitization for?

Full disclosure - I didn't write the function and I'm not fantastic with regex.

value = value.replace(/[^a-z0-9áéíóúñü .,_-]/gim, "").trim();

it's a whitelist, so add more characters you want to whitelist — Keith Nicholas, Mar 08 '20 at 23:16

Mohamed Magdy · Answer 1 · 2020-03-08T23:43:59.413

-2

The sanitization concept is mainly aimed for sanitizing data from bad characters before being saved in database or processed with any type of queries. That said, you shouldn't care about sanitizing data at front end so much because javascript can be disabled. Any thing in client side can be bypassed. You should care so much about that at back end. Sanitization should be done for data before saving in database. Escaping should be done for data after retrieving from database.

edited Mar 08 '20 at 23:43

answered Mar 08 '20 at 23:17

Mohamed Magdy

535
5
9

Sanitizing on the front end is common to prevent XSS. – Josiah Keller Mar 08 '20 at 23:19
@JosiahKeller, clinet side sanitization doesn't prevent XSS. – Mohamed Magdy Mar 08 '20 at 23:22
Javascript can be disabled easily, please refer to this question: https://stackoverflow.com/questions/44488156/how-to-sanitize-js-and-html-in-inputs – Mohamed Magdy Mar 08 '20 at 23:24
This isn't correct. client side sanitization doesn't prevent XSS. – Mohamed Magdy Mar 08 '20 at 23:27
@JosiahKeller Please do google search and provide any source that says client side sanitization prevents XSS attacks. Anything on client side can be bypassed. – Mohamed Magdy Mar 08 '20 at 23:35
I think we're talking about different things - I'm talking about inserting new content into the document. – Josiah Keller Mar 08 '20 at 23:39
@JosiahKeller and I am talking about even I prevented the new content from having bad characters, still, any one can override that data been sent to the server. It is ok to have a sanitizer in front end but to say "it is enough" , this can't be correct. – Mohamed Magdy Mar 08 '20 at 23:43
this shouldn't be an answer, it should be a comment – Keith Nicholas Mar 09 '20 at 00:31
@KeithNicholas Why? He is asking: Do I need to modify the function to be less aggressive, or should I simply not use the sanitize function at all? – Mohamed Magdy Mar 09 '20 at 04:42

Sanitize function too sanitary?

1 Answers1