Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

As we all know by now, XSS attacks are dangerous and really easy to pull off. Various frameworks make it easy to encode HTML, like ASP.NET MVC does:

<%= Html.Encode("string"); %>

But what happens when your client requires that they be able to upload their content directly from a Microsoft Word document?

Here's the scenario: People can copy and paste content from Microsoft word into a WYSIWYG editor (in this case tinyMCE), and then that information is posted to a web page.

The website is public, but only members of that organization will have access to post information to a webpage.

How do I handle these requirements in a secure fashion? Currently there is no checking done on what the client posts (since only 'trusted' users can post), but I'm not particularly happy with that and would like to lock it down further in case an account is hacked.

The only conceptual method that I'm aware of that meets these requirements is to whitelist HTML tags and let those pass through. Is there another way? If not, What is a secure way to let the user store input in the Database in any form, but only display it properly encoded and stripped of bad tags?

Related Question

Preventing Cross Site Scripting (XSS)

share|improve this question

migrated from stackoverflow.com Jan 30 '11 at 20:03

This question came from our site for professional and enthusiast programmers.

    
Nice question- here is a similar one though- stackoverflow.com/questions/445177/… –  RichardOD Jun 18 '09 at 19:52
    
Agreed. It is similar, but it is a confusing question (The question is hard to find), and it doesn't specifically ask if there's any other way. If there's another way to render HTML without having to Whitelist, I'm all about it. If there's a ASP.NET MVC View Engine that takes care of this, that's good to know too. –  George Stocker Jun 18 '09 at 19:57
    
On a non-security related note, filtering tags will probably be helpful from a user interface perspective. It is very easy to accidentally type an angle bracket and forget to escape it. Since we're talking about users who are copying from Word, it's a good idea to catch what looks like bad tags and encode them appropriately (i.e. &amp;lt;) so that things Just Work. –  Conspicuous Compiler Jun 29 '09 at 11:56
    
Regarding point #4: You bet it's still an issue! Most hacks are an inside job, after all. For a specific editor, I've had good luck using FreeTextBox but I can't speak to how well it matches up to your requirements, especially MVC. –  Joel Coehoorn Jul 3 '09 at 23:55
1  
@gnat Thanks; edited. Looks like my question has gotten the attention of some sort of cabal; three downvotes in rapid succession, and your protection and edit request. –  George Stocker Jan 26 at 15:33

5 Answers 5

The easiest way (for you as a developer) is probably to implement one of many variations of Markdown, for example Markdown.NET or, even better (imho), a wmd-editor.

Then, your users would be able to paste simple HTML, but nothing dangerous, and they would be able to preview their entered data and straighten out any scruples even before posting...

share|improve this answer
    
I believe StackOverflow use a custom editor without the need for WMD syntax –  Jon Jun 22 '09 at 11:15
1  
StackOverflow does indeed use WMD. blog.stackoverflow.com/2008/05/… stackoverflow.com/questions/98852/… –  Tomas Lycken Jun 22 '09 at 12:29
    
What do you mean by WMD syntax? As far as I can tell, all WMD syntax works. And I haven't yet found anything that doesn't work... –  Tomas Lycken Jun 24 '09 at 8:55
2  
The problem with using Markdown is that markdown allows arbitrary HTML; so by itself it is not a solution. –  George Stocker Jan 26 at 13:20

Whitelisting is indeed the best way to prevent XSS attacks when allowing users to enter HTML, either directly or using a Rich Text Editor.

About your other questions:

Is there a WYSIWYG editor that includes the ability to whitelist on the fly?

I don't think this could work. You need server side code for this and the RTE runs on the client.

TinyMCE filters tags if you want but since this takes place in the browser you can't trust it. See extended_valid_elements. TinyMCE (Moxie) also suggests whitelisting, see here.

Should I even worry about this since it will only be for 'private posting'

You should always filter HTML unless there are specific reasons not to (very rare). Some reasons: a) functionality that is for internal users today maybe for the public tomorrow b) unauthorized access will have less of an impact

is the best way to let them store it in the Database in any form, but only display it properly encoded and stripped of bad tags?

That is the way I prefer it. I don't like to change user input before inserting into the database for various reasons.

share|improve this answer

I am doing the same thing. I am using TinyMCE and allowing pasting from Word documents. Only certain people that maintain the site can do this via an admin area. This is secured by ASP.Net Membership. I'm simple doing the HTML.Encode when it gets sent out to the public site.

You could use the code below if you like before it gets put in the database but not sure what knock on affect it would give you. You may have to go with your whitelist.

 /// <summary>
    /// Strip HTML
    /// </summary>
    /// <param name="str"></param>
    /// <returns></returns>
    public static string StripHTML(string str)
    {
        //Strips the HTML tags from strHTML 
        System.Text.RegularExpressions.Regex objRegExp = new System.Text.RegularExpressions.Regex("<(.|\n)+?>");

        // Replace all tags with a space, otherwise words either side 
        // of a tag might be concatenated 
        string strOutput = objRegExp.Replace(str, " ");

        // Replace all < and > with < and > 
        strOutput = strOutput.Replace("<", "<");
        strOutput = strOutput.Replace(">", ">");

        return strOutput;
    }
share|improve this answer
    
If they store text such as <script>alert("hey")</script> and you do Html.Encode(<script>alert("hey")</script>) it will just print that to page not run the alert –  Jon Jun 18 '09 at 20:27
    
I'm not using a whitelist, I am just storing it as is. The above function could help but I dont know what knock on affect it will have. Would like to know what you decide. Why is my post marked as negative? –  Jon Jun 19 '09 at 8:46
1  
I would guess that's because the way your software is doing it is a very naive implementation; there are all sorts of tricks that will get around your implementation. –  George Stocker Jun 19 '09 at 16:12
4  
A whitelist is a good idea, but your method certainly is not. Regex is not a reliable way to detect tags in text, as HTML can get pretty obfuscated. Much better to use a library such as the HTML Agility Pack. –  Noldorin Jul 4 '09 at 0:02

My IMHO keep trusting your users until you will go public.

Well, there is no reliable way to achieve your needs. For example any WYSIWYG editor fail to protect form inserting images with URLs (indirect usage track, illegal content) or text (illegal text, misspelled text, missized text).

My point of view is that if you can trust your users, simply allow everything, just warn users if there are KNOW dangerous markup (to keep them from errors).

If you do not trust, use sort of special markup (e.g. Markdown).

In my project we use special types for potentially dangerous content and special methods for rendering and accepting such content. This code has high mark in our thread model and attention to it is very high (for example each change should be reviewed by two independent coders, we have comprehensive test suite and so on).

share|improve this answer

One option might be the HTML Edit Control for .NET (which I wrote).

It's a WYSIWYM HTML editor for .NET, which only supports a subset of the HTML elements, excluding <script> elements: so in that way it acts as a whitelist.

If it's for internal use (i.e. an intranet site), then the control can be embedded in a web page.

I haven't integrated support for pasting from Word, but I do have a component which is a step in that direction: a Doc to HTML converter; so I have the building blocks which you could use in ASP.NET to convert a Doc to HTML, display the HTML in the editor, etc.

share|improve this answer

protected by gnat Jan 26 at 12:18

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.