HTML parsing and sanitising: inside the standard
You study the parsing rules, error recovery and DOM construction in the HTML standard and see through your own experiments why a safe HTML sanitiser is hard.
Level 501 · 13 lessons · 12 practice labs
Lessons
The parsing algorithm
- Learning to read the HTML standard
- Tokenizer states
- Tree construction and insertion modes
- Error recovery: unclosed and misnested tags
- Short task: predict the DOM of broken HTML
Special contexts
- The special rules of script, style and textarea
- Parsing inside SVG and MathML
- Serialisation and round-trip differences
- Short task: find a fragment that changes on a round trip
Sanitising
- Designing an allowlist-based sanitiser
- Comparing the Sanitizer API and DOMPurify
- Locking down dangerous sinks with Trusted Types
- Capstone: test a sanitiser and report on it
Practice labs
- Predict the tree of broken HTML: Predict the DOM of five broken fragments and compare with html5lib's output.
- Untangle misnested tags: Explain with the adoption agency rules what tree a text with crossed b and i tags becomes.
- Explain foster parenting in tables: Show where text written straight inside a table ends up by following the insertion modes in the standard.
- Observe textarea and script content: Show with examples why tags written inside textarea, title and script are not parsed as tags.
- Spot different parsing inside SVG: Prepare three examples where one fragment builds a different tree in HTML and SVG contexts and explain why.
- Find a fragment that changes on a round trip: Find a fragment whose meaning changes when serialised with innerHTML and parsed again, and write why it is dangerous.
- Build an allowlist: Write a simple allowlist sanitiser for a comment box that only permits b, i, a and p.
- Try to bypass a sanitiser: Run your sanitiser against a list of malicious fragments, find the ones that get through and close them.
- Compare sanitisers: Run the same twenty inputs through your sanitiser, DOMPurify and the Sanitizer API and report the differences.
- List dangerous sinks: Find every place the sample app uses innerHTML, eval and document.write and list them.
- Turn on Trusted Types in report mode: Enable Trusted Types in report-only mode with CSP and classify the incoming violations.
- Enforce Trusted Types: Fix the remaining violations with a policy, enforce Trusted Types and verify the app still works.
About this course
You study the parsing rules, error recovery and DOM construction in the HTML standard and see through your own experiments why a safe HTML sanitiser is hard.
What you will learn
- The parsing algorithm
- Special contexts
- Sanitising
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.