0

How do I clean a discussion forum post from XSS attacks in EE?

A bit of background, I'm using the EE discussion module and I've dropped in ckeditor so the user can easily embed youtube/vimeo videos and images. I set "HTML Formatting in posts" to "Allow all HTML" so it will accept the iframed videos. However this leaves it open to XSS attacks as users can then put in any scripts they like. I'd like to whitelist just iframes to youtube & vimeo, links, images and a few tags like p and strong.

I thought of adjusting the settings in the discussion module but they seem very much hardcoded. I thought of using http://htmlpurifier.org/ to whitelist tags but the forum_submit_post_start hook doesn't contain the post content and I guess by the time the forum_submit_post_end hook is called it's too late.

Any ideas?

Improve this question
4
  • 1
    XSS filtering occurs on input, the HTML formatting preference is on output. How is the addition of ckeditor allowing those tags to be stored in the database? iframe is one of many blacklisted tags that are never accepted on front end input.
    – Derek Jones
    Apr 16, 2015 at 15:56
  • I removed iframe from the $naughty list in system\codeigniter\system\core\Security.php so it would accept iframes. But I only want it to accept iframes where the src is using the youtube or vimeo domain.
    – Patrick64
    Apr 16, 2015 at 16:25
  • That is very dangerous, I would not make that modification. Have you looked into various plugins that exist for users to submit videos for? The plugin builds the markup instead of the user, so you don't have to worry about that input.
    – Derek Jones
    Apr 16, 2015 at 16:51
  • Yes, I had a look around but I can't find one that would work with ckeditor + EE's discussion module.
    – Patrick64
    Apr 17, 2015 at 9:17

1 Answer 1

Reset to default
0

You have tried to use this simple solution: https://devot-ee.com/add-ons/custom-bbcode ?

Improve this answer
1
  • Thanks, that looks good but I'm using ckeditor rather than BBcode so I don't think it would work in this case.
    – Patrick64
    Apr 17, 2015 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.