If I were to create a site where users could put arbitrary html into their 'profile' or something similar, how might I prevent JavaScript embedded in that html from running?
Could I put an infinite loop for(;;); somewhere? If so, where would I put it?
What other security concerns are associated with this approach?
Umm, the infinite loop would just hang the browser.
For PHP, I would recommend HTML Purifier to keep evil HTML out by only letting in the good stuff :)
Python HTML Sanitizer seems like a good option for Python, as well, though I haven't had the chance to try it. This StackOverflow question offers some simple HTML sanitizer solutions using BeautifulSoup, but be sure to be careful with that first answer - it looks like it doesn't have an attribute whitelist, which is vital for safe code, as well.
You should use a white-list approach. When you display the profile you should first HTML-encode everything, and from there you can decode the HTML elements that you allow. That way only the specific elements and attributes that you have specified are usable, and there is no way to sneak any code around it by using something that you didn't think of.