How can I disallow Javascript and CSS entered into WYGWAM fields?

Question

I have a client that has a nasty habit of entering <style> and <script> tags and style="" attributes to WYGWAM content and I need to be able to cut them off at the pass. They should hire me to do that for them!

So what I need is to delete anything entered in a WYGWAM field that matches these tags and attributes.

Possible?

Answer 1

NB This P&T support thread seems to suggest that CKEditor (which is the editor WYGWAM is based should automatically strip <script> tags, so might be worth checking your themes/third_party/wygwam/lib/ckeditor/config.js file and asking on their Get Satisfaction if that isn't the case for you.

That aside. even if you can do this in CKEditor, my attitude would be that this isn't something you can do robustly in JavaScript, so ideally we need to either fix this on save (with an extension) on on output in your templates (with a plugin).

With an extension:

I'm not aware of an existing extension that will do this, but if you have the PHP chops you could probably hook something up to entry_submission_start, and then use $this->EE->security->xss_clean() or similar to strip script tags (though this may not be the best option for your application).

With a plugin:

Generally it's always safer to whitelist tags rather than blacklist the one's you don't want to allow, so one (easy to implement) option would to strip tags on output using a plugin like SuperGeekery Tag Stripper or Hacksaw:

{exp:eehive_hacksaw words="100" allow="<p><b>"}    
  {your_content}
{/exp:eehive_hacksaw}

If you go down this route I'd tend to use a snippet to share my permitted tags across templates:

{exp:eehive_hacksaw words="100" allow="{sn_permitted_tags}"}    
  {your_content}
{/exp:eehive_hacksaw}