{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "rich-text-output-boundary-brief",
  "group": "content-data",
  "title": [
    "Rich text needs a declared output boundary",
    "富文本交付，要明确哪些内容可以输出"
  ],
  "intro": [
    "A business commissioning a CMS may want bold text and links without granting authors the ability to run scripts. “We escape everything” and “the editor produces HTML” answer different requirements. Agree the allowed rich-text vocabulary, the maintained sanitisation layer and what happens after it runs.",
    "采购CMS时，企业可能需要粗体和链接，却不希望作者能运行脚本。“全部转义”和“编辑器输出HTML”回答的是不同要求。应约定允许的富文本范围、持续维护的净化层及其后续处理。"
  ],
  "facts": [
    [
      "OWASP recommends HTML sanitisation when intended rich HTML must render, and warns that modifying the result afterwards can invalidate that protection. Context-aware output encoding is appropriate when displaying plain text.",
      "OWASP建议在需显示富HTML时使用HTML净化，并提醒净化后再修改可能使保护失效；显示纯文字则应按上下文输出编码。",
      "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#html-sanitization"
    ]
  ],
  "example": [
    [
      [
        "Approved vocabulary:p,strong,a with reviewed URL schemes",
        "Author supplies<strong>Offer</strong>",
        "Retain formatting only through maintained approved sanitizer"
      ],
      [
        "批准范围p、strong及审核URL协议的a",
        "作者输入<strong>Offer</strong>",
        "仅通过持续维护的净化器保留格式"
      ]
    ],
    [
      [
        "Plain customer reference field",
        "Input contains literal< and >",
        "Show characters as text; do not turn it into rich HTML"
      ],
      [
        "普通客户编号字段",
        "输入含字面<和>",
        "按文字显示，不转换为富HTML"
      ]
    ],
    [
      [
        "Sanitized fragment",
        "Later library adds event attributes",
        "Reject pipeline; earlier sanitisation is no longer enough"
      ],
      [
        "已净化片段",
        "后续库又加事件属性",
        "拒收流程；先前净化已不足"
      ]
    ],
    [
      [
        "Input has an unapproved embedded iframe",
        "No approved embed contract",
        "Reject or remove under policy; never assume editor trust"
      ],
      [
        "输入含未经批准的iframe",
        "没有批准的嵌入规则",
        "按规则拒绝或移除，不能默认编辑器可信"
      ]
    ]
  ],
  "steps": [
    [
      "Write separate policies for plain text, rich text and approved embeds. Give the supplier benign formatting examples plus inert strings representing disallowed elements and attributes.",
      "分别写纯文字、富文本和获准嵌入规则，提供正常格式例及代表禁用元素属性的惰性文字。"
    ],
    [
      "Ask the supplier to retain raw input and redacted final output in an isolated authorised test. Compare preserved meaning, removed capabilities and every transformation after sanitisation.",
      "在获准隔离测试中保留原输入与脱敏最终输出，核对语义、去掉的能力及净化后的每项转换。"
    ],
    [
      "Record sanitizer/version/maintenance responsibility and test the actual output context with qualified security review. Do not ship a regular-expression replacement as a general sanitizer.",
      "记录净化器、版本及维护人，结合专业安全复核检查实际输出上下文；不能用正则替换冒充通用净化器。"
    ]
  ],
  "result": [
    "The table is a concrete output-policy decision, not an executable sanitizer. Its original boundary prevents two opposite defects: rendering plain references as HTML and destroying all legitimate CMS formatting. The third row requires review of the entire pipeline rather than one library badge.",
    "本表规定具体输出策略，不是可执行净化器。它同时避免把普通编号渲染成HTML、把合法CMS格式全破坏；第三行要求核对整个处理链，而非只看某库标志。"
  ],
  "accept": [
    "Require the agreed safe representation and retained meaning for each supplied case, plus implementation-specific security evidence. Missing sanitizer or a post-sanitisation mutation blocks component acceptance.",
    "各例须满足批准表示及语义，并提供实现相关安全证据；缺少净化器或净化后再次引入能力，应阻止组件验收。"
  ],
  "limit": [
    "Inert synthetic strings only; no exploit is executed and no general-purpose sanitizer or security certification is supplied. The actual maintained implementation remains the supplier’s responsibility.",
    "仅使用惰性合成文字，未运行攻击、不提供通用净化器或安全认证；实际持续维护的实现由供应商负责。"
  ],
  "oldLinks": []
}