TryGhost/Ghost — pull request #1633 by jgillich (2013-12-08 01:55:57+00:00)
Title: Replace validator's xss() with caja's sanitize()

This is not yet ready (tests fail for some reason), just putting it here for feedback.

As discussed in #1378, this replaces node-validator's xss filterting with the one from caja.

When you look at the changes, you will notice that this does not escape or replace the elements, instead it removes them entirely. This means that if you enter something like `` in the title, you get told that an empty value isn't allowed. Probably not the best way to handle this.

I did some digging and as far as I can see, escaping would require us to modify caja heavily. What we could easily do is white/blacklisting of elements & attributes (sanitize() uses a internal list of elements that it considers unsafe, probably fine for our use case), but escaping instead of removing them is not really what it's been made for.