search

GetmeUK / ContentTools

A JS library for building WYSIWYG editors for HTML content.
http://getcontenttools.com
MIT License
3.96k stars 395 forks source link

Sanitising Input #403

Closed zeraphie closed 7 years ago

zeraphie commented 7 years ago

Hey there,

I've been wondering how content tools handles sanitising input and escaping html (to prevent stuff like cross-site scripting) as this is one of the requirements for the system I'm making to be secure, but I haven't really been able to find how it handles it (I do know that it looks like it does escape it.... just not sure how)

tl;dr Looking for documentation/faq style stuff on how content tools handles sanitising/escaping/csrf-vulnerabilities

Thanks!

anthonyjb commented 7 years ago

Hi @zeraphie - the short answer is it doesn't - you can't rely on a client side library such as CT sanitising the HTML submitted by a user to your site. That task is something that can only safely be performed server side and as such is outside the scope of CT.

What CT does do is provide some basic validation of HTML when user's use the code editor tab in the properties dialog and allow you to restrict the attributes which can be edited against different tag types. However none of these will prevent a user maliciously (or otherwise) sending you server-side save script unsafe content.

Ant

zeraphie commented 7 years ago

Thank you, I had had a discussion about this at the workplace, and am doing the sanitising via PHP which is how I thought it'd happen, it just seemed like there was something already happening :)

anthonyjb commented 7 years ago

No problem - sounds like you're handling it correctly :D