XSS Prevention Architecture

Rendering flowable documents (like EPUB or DOCX) ultimately involves converting structural markup into DOM nodes. This creates a massive vector for Cross-Site Scripting (XSS) if a malicious payload is embedded in the document text.

The Sanitization Pipeline

Before any parsed HTML string is attached to the document object via innerHTML, it must pass through a strict sanitization layer. We utilize a highly constrained configuration of DOMPurify.

Specific Question: How do we handle valid scripts inside EPUBs?

The EPUB3 specification allows for interactive elements via JavaScript. We strictly ignore this spec. All <script> tags, onclick attributes, and javascript: pseudo-protocols are aggressively stripped. uViewDoc is a reader, not an interactive application engine.

HTML Element / Attribute	DOMPurify Action
<p>, <h1>, <em>	Allowed
<iframe>, <object>	Removed
href="javascript:..."	Attribute Purged

Common Mistakes in Sanitization

Regex Replacing: Attempting to strip scripts using Regular Expressions (e.g., replace(/<script>/g, '')) is inherently flawed and easily bypassed with malformed attributes. Always use a DOM-based parser like DOMPurify.
Trusting SVGs: SVGs are essentially XML documents and can contain embedded <script> tags. They must be explicitly sanitized, not just treated as static images.

Frequently Asked Queries

Q: Does this break syntax highlighting in code blocks?
A: No. Code blocks are correctly HTML-encoded (e.g., < becomes <) by the parser before sanitization, so they render safely as text.

Q: Why did my document's embedded form disappear?
A: Form elements (<form>, <input>) are permitted, but action attributes pointing to external URLs are scrubbed to prevent data exfiltration phishing.

Cited Statistics

The Open Web Application Security Project (OWASP) consistently ranks XSS in the top 3 most prevalent web vulnerabilities. Local rendering engines that fail to sanitize DOM injection effectively bring that web vulnerability directly to the desktop.