Remove JavaScript with Regex

It is generally agreed upon that trying to parse HTML with regex is a bad idea and will yield bad results. Instead, you should use a DOM parser. jQuery wraps nicely around the browser's DOM and would allow you to very easily remove all <script> tags.

ok I have faced a similar case, when I need to clean "rich text" (text with HTML formatting) from any possible javascript-ing.

there are several ways to add javascript to HTML:

• by using the <script> tag, with javascript inside it or by loading a javascript file using the "src" attribue. ex: <script>maliciousCode();</script>

• by using an event on an HTML element, such as "onload" or "onmouseover" ex: <img src="a.jpg" onload="maliciousCode()">

• by creating a hyperlink that calls javascript code ex: <a href="javascript:maliciousCode()">...

This is all I can think of for now.

So the submitted HTML Code needs to be cleaned from these 3 cases. A simple solution would be to look for these patterns using Regex, and replace them by "" or do whatever else you want.

This is a simple code to do this:

public static string CleanHTMLFromScript(string str)
{
    Regex re = new Regex("<script[^>]*>", RegexOptions.IgnoreCase);
    str = re.Replace(str, "");
    re = new Regex("<[a-z][^>]*on[a-z]+=\"?[^\"]*\"?[^>]*>", RegexOptions.IgnoreCase);
    str = re.Replace(str, "");
    re = new Regex("<a\\s+href\\s*=\\s*\"?\\s*javascript:[^\"]*\"[^>]*>", RegexOptions.IgnoreCase);
    str = re.Replace(str, "");
    return(str);
}

This code takes care of any spaces and quotes that may or may not be added. It seems to be working fine, not perfect but it does the trick. Any improvements are welcome.

Creating your own HTML parser or script detector is a particularly bad idea if this is being done to prevent cross-site scripting. Doing this by hand is a Very Bad Idea, because there are any number of corner cases and tricks that can be used to defeat such an attempt. This is termed "black listing", as it attempts to remove the unsafe items from HTML, and it's pretty much doomed to failure.

Much safer to use a white list processor (such as AntiSamy), which only allows approved items through by automatically escaping everything else.

Of course, if this isn't what you're doing then you should probably edit your question to give some more context...

Edit:

Now that we know you're using C#, try the HTMLAgilityPack as suggested here.

Which language are you using? As a general statement, Regular Expressions are not suitable for parsing HTML.

If you are on the .net Platform, the HTML Agility Pack offers a much better parser.

You should use a real html parser for the job. That being said, for simple stripping
of script blocks you could use a rudimentary regex like below.

The idea is that you will need a callback to determine if capture group 1 matched.
If it did, the callback should pass back things that hide html (like comments) back
through unchanged, and the script blocks are passed back as an empty string.

This won't substitute for an html processor though. Good luck!

Search Regex: (modifiers - expanded, global, include newlines in dot, callback func)

  (?:
     <script (?:\s+(?:".*?"|\'.*?\'|[^>]*?)+)? \s*> .*? </script\s*>
   | </?script (?:\s+(?:".*?"|\'.*?\'|[^>]*?)+)? \s*/?>
  )
|
  (   # Capture group 1
    <!(?:DOCTYPE.*?|--.*?--)>  # things that hide html, add more constructs here ...
  )

Replacement func pseudo code:

string callback () {
  if capture buffer 1 matched
    return capt buffer 1
  else return ''

}