WMD Markdown and server-side

Question

Hello,

I work since 2 days on WMD & Markdown and i don't find THE solution for stock data with security. I would like users can post html/xml (with WMD) on my site. For the moment, I stock data in Markdown format but If I disabled JavaScript the user can push easy XSS. If I strip_tags or html_entities all data i loose the user html/xml . How can I do ?

In my opinion I must html_entities just the code between pre /pre, but how?! my data is in Markdown.

After, how I can do for forbid xss attributes :

<img src="javascript:alert('xss');" />

Sorry for my rusty english.

MaxoU

Answer 1

To "clean" your HTML, you could use a tool like HTML Purifier

Basically, it allows you to specify which tags/attributes are allowed, an only keeps those.

It also produces valid (X)HTML code as ouput -- which is nice.

You can see on the demo page there is an example that is almost exactly the XSS you posted, btw ;-)

For instance, you can try with some HTML like this one :

test <img src="javascript:evil();" onload="evil();" /> 
test <img src="http://www.google.com/a.Png" /> test2

The output is :

test  test <img src="http://www.google.com/a.Png" alt="a.Png" /> test2

The img tag with XSS has not been kept ; the other one has ; and there's been an alt attribute added, to be standard-compliant.

It might not solve all your problems, but if you are giving users the possiblity to input HTML, is it definitly useful (would I dare saying "it's a must-have" ? )