Unsafe Html

Question

I'm building a simple web based forum application. I want to allow users to include html in their posts, but would like to stop any cross site scripting. My current stratagy is to not allow any "script" tags, to only allow "style" and "href" attributes on any tag, and to not allow "href" values to start with "javascript:". Is there anything that I'm missing?

UPDATE: I ended up solving this with a "whitelist" of html elements. When invalid elements are found, I strip off the tag but leave the inner html. This solves the problem of people copying and pasting from a MS Word document. I also looked into antisamy.net but ran into some issues with how it handled style attributes on spans (i.e. removes them). If I can get that worked out I may switch over to that solution.

Answer 1

Make sure you take out iframe, object, embed. There's quite a lot actually.

Perhaps what would be better is to allow Markdown instead?

Answer 2

You should follow the approach of StackOverflow and other sites, and use a whitelist for both tags and attributes. It sounds like you're using a whitelist for attributes, which is good. You should do so for elements as well so people don't sneak things in like form, iframe, meta, frameset, etc. (none of which you mentioned).

Answer 3

I'd look at removing any onclick or really on[anything] tags. It might be easier to build a list of what's allowed instead of a blacklist.

Answer 4

What do you say about:

style='background-image:url("my-site-which-inserts-something-that-will make-you-look-bad")'

And not entirely connected: make sure that if you allow people to upload files to the sites (images/txt/whatever) that they will be served from a different domain name.

Answer 5

If you are using PHP you can strip out everything but the elements you want to allow with strip_tags

strip_tags(string,allow)

This would output:

<?php
echo strip_tags("Hello <b><i>world!</i></b>","<b>");
?>

Hello world!

You should use this approach with:

mysql_real_escape_string();
htmlentities();

Answer 6

A whitelist is the safest solution.

You mentioned in a comment about pasting from Word. Don't count on knowing all of Word's HTML elements, it often comes back with crap like <o:p> for paragraphs (which generally only work as expected in Internet Explorer). You may be able to find most of these but there could easily be some dangerous tags, perhaps an <o:script> tag or something.

By the way, there really aren't that many HTML tags. The W3.org index of elements will help you.