Sanitize user submitted HTML but keep safe embedded iframes
问题 I need to sanitize user inputs of malicious html & submitted by CKEditor . I currently use owasp-java-html-sanitizer . for this purpose but it removes embedded iframes as well. But I have genuine use cases like embedding a YouTube video or slide share presentation within posts. How could I allow such embedded iframes safely? I use Java. 回答1: You will need to allow the iframe element and source attribute to your Html policy. You can do it like the following example modified from the java doc /