How to prevent XSS attacks through this HTML code?

I

IvanIF2020-11-09 22:05:23

XSS

IvanIF, 2020-11-09 22:05:23

I have a form on my site where users can enter the HTML code of a google map.
Here is an example code:

<iframe src="https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d2194.348202713491!2d43.4474173159526!3d56.63387898079813!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x0%3A0x0!2zNTbCsDM4JzAyLjAiTiA0M8KwMjYnNTguNiJF!5e0!3m2!1sru!2sru!4v1604948399683!5m2!1sru!2sru" width="600" height="450" frameborder="0" style="border:0;" allowfullscreen="" aria-hidden="false" tabindex="0"></iframe>

How to prevent XSS attacks through this HTML code? Fully check it regularly? And if google suddenly decides to change the code of such maps, then change the regular expression as well?

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

I

IvanIF, 2020-11-09
@IvanIF

Seems to have come up with a solution. I will extract the value of the src (link) attribute from the code entered by the user, run it through htmlspecialchars and independently wrap it in everything else.