NCIOCPL / cgov-digital-platform

The Cancer.gov Digital Communications Platform
GNU General Public License v2.0
11 stars 33 forks source link

Enabler: Disable pasting images into the WYSIWYG #4478

Open blairlearn opened 2 weeks ago

blairlearn commented 2 weeks ago

Don't allow users to paste binary objects into the WYSIWYG editor.

If a user attempts to paste a binary object (e.g. an image) into the WYWIWYG editor, CKEditor will happily turn around and base64 encode it, resulting in a large amount of data being stored and the CMS no longer being able to load the page.

This needs to be prevented.

scientific and career achievement.</p>

<p paraeid="{f041546b-c3dc-4f85-b320-61cccd0053e4}{5}" paraid="942176203">&nbsp;&nbsp;<img alt="" height="221" src="data:image/jpeg;base64,/9j/4SjdRXhpZgAASUkqAAgAAAAKAA8BAgASAAAAhgAAABABAgAKAAAAmAAAA
BoBBQABAAAAogAAABsBBQABAAAAqgAAACgBAwABAAAAAgAAADEBAgA1AAAAsgAAADIBAgAUAAAA6AAAADsBAgAWAA
AA/AAAAJiCAgAbAAAAEgEAAGmHBAABAAAALgEAAPADAABOSUtPTiBDT1JQT1JBVElPTgBOSUtPTiBaIDYALAEAAAE
AAAAsAQAAAQAAAEFkb2JlIFBob3Rvc2hvcCBMaWdodHJvb20gQ2xhc3NpYyAxMy4wLjEgKE1hY2ludG9zaCkAADIw
MjM6MTA6MTcgMTQ6

Potentially, this can be addressed via the Advanced Content Filter. The suggestion is to "create a CKEditor package without the image plugin."

Another possibility: a plugin to block images from being pasted: https://camerongregor.com/2016/11/14/preventing-pasting-of-images-in-ckeditor/

ESTIMATE TBD

Resources:

Prerequisites

Sub-Tasks

Notes

jfrank-nih commented 2 weeks ago

If I had to guess, these are objects in Word documents.

blairlearn commented 2 weeks ago

Unsanitized pastes from Word Documents are the source of much suffering.