Insecure Sanitizer Policy

Usage of user-controlled or untrusted data to define HTML sanitizer policy could allow an attacker to circumvent the sanitization requirements and launch cross-site scripting (XSS) attacks.

The umbrella term "input handling" describes functions such as validation, sanitization, filtering, and encoding/decoding of input data. Cross-site scripting, SQL injection, and process control vulnerabilities all stem from incorrect or absent input handling. Sanitization of input, which entails transforming input to an acceptable form, is typically implemented in addition to input validation. HTML sanitization refers to cleansing and scrubbing user input to allow only tags, attributes, and elements that are deemed safe.
Implementing a thorough HTML sanitization policy is difficult; the key to successful implementation is understanding the context in which the data will be used. Each context has its own vulnerabilities, and one size does not fit all. While it is wise to use an HTML sanitizer (for example the OWASP HTML sanitizer) to protect against XSS vulnerabilities in web applications, improper implementation can lead to a false sense of security.
Example 1: The following Java code uses user-controlled input variable elements in building an HTML sanitizer policy:

...
String elements = prop.getProperty("AllowedElements");
...
public static final PolicyFactory POLICY_DEFINITION = new HtmlPolicyBuilder()
															.allowElements(elements)
															.toFactory();

....

A malicious user can cause the HTML sanitizer policy to accept dangerous elements like <script> by supplying them to elements.