How can I secure user submitted HTML markup?

Question

Before I start I'd like to say I have read similar questions here but I don't think it really answers the question: Show HTML user input, security issue and Security risks from user-submitted HTML

I think these highlight the problems quite well but I am essentially asking advice for best practice in these circumstances.

I have been programming for a while and have just now come to the point where I want website administrators to submit HTML markup to display the content they want in their own sites.

Securing this content in the database is fine but now I want to display it on the site securely.

Even though, this feature is only available to the site admins I still want to secure against malicious script injections and try to prevent them breaking the page by using poor HTML.

Is the reality that I cannot safely guard against script injections as the threads above seemed to point out?

Do I use the mentality that if they break the site, it's down to them, or can I use some sort of markup validator when they update the content?

what language are you coding? what possible script injections are you talking about? do you want to allow html but forbid javascript? can you give examples? — nl-x
– nl-x, Commented Jun 7, 2013 at 22:06
You could just whitelist certain html tags, depending on what content theyre uploading. Like for instance just allow <p><h1><h2><h3><br><img><div> I believe TinyMCE has this built in...but thats only client side....you should still check and sanitize server side — Kylie
– Kylie, Commented Jun 7, 2013 at 22:07

GodFather · Accepted Answer · 2013-06-07 22:14:37Z

1

What do you think about markdown?

It's a safe way to submit html, and have libraries to most popular languages.

answered Jun 7, 2013 at 22:14

GodFather

3,1964 gold badges28 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Comfortably Numb · Accepted Answer · 2013-06-07 22:11:33Z

0

You're correct, if you allow to submit pure HTML - there's no way to prevent all possible injections. Even if you disable <script> tag in all it's possible combinations (and there're many) there're other ways like onfocus onmouseover events that can be used to run malicious code.

edited Jun 7, 2013 at 22:11

answered Jun 7, 2013 at 22:05

Comfortably Numb

39.9k17 gold badges82 silver badges147 bronze badges

Comments

André Catita · Accepted Answer · 2013-06-07 22:18:17Z

0

I would advice HTMLPurifier, it's the best solution out there for sure. Google it!

answered Jun 7, 2013 at 22:18

André Catita

1,32316 silver badges19 bronze badges

Collectives™ on Stack Overflow

How can I secure user submitted HTML markup?

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related