How to enable WYSIWYG editors and disable XSS attacks using Laravel?

Question

I have an enterprise-level application where registered users are allowed to post articles to a page using the WYSIWYG editor. (This app can be thought of as a website creator.)

Everything works fine, but there are problems;

• The WYSIWYG editor publishes an HTML article, as well as some localized string characters that Laravel doesn't like, so the Laravel alpha_num check cannot pass. (Therefore, we do not use it when checking validation.)

• We need to allow characters like < , " , > because they may want to make some basic style using the WYSIWYG editor, so htmlspecialchars() not an option when echoing / sanitizing values, because harmful things like <br> break

• Users can post things like <script type="text/javascript>alert('Hello');</script> or </div></div></div><div style="width: 100%, height: 100% z-index: 999999"> . I know that this is a huge security risk, but we cannot secure / avoid anything at all. Users will still be able to write <s<!---->cript> and pass the check.

So, in a word, we cannot rely on some of the built-in functions of Laravel and PHP. We also cannot disable the WYSIWYG editor because it is often used in most areas of the oral application.

What is the best way to avoid this?

I am thinking of creating a custom rule on top of alpha_num in Laravel, which will be called alpha_num_localised_characters_plus_allowed_html_tags and will add this rule to any input containing the WYSIWYG editor.

Is this a good way? Is there a better alternative? How do you deal with such problems yourself?

Note. Please note: we have already developed an application with a huge size, we will rely on the fastest and most convenient solution for you.

Answer 1

You can use a tag system similar to BBCode or Markdown to allow your users to perform a specific operation. Thus, you can be sure that the input will be cleared of EVERY kind of malicious script, just use the lexer and XSS protection when displaying custom content.

EDIT: to see what I mean, you can use CKEditor as the WYSIWYG editor in conjunction with the BBCode plugin :

Answer 2

Can you run everything through strip_tags and allow minimum labels?

You can also look at the html cleaner , which should provide you with more options, including css management

I usually save two copies of WYSIWYG content:

• original unfiltered content
• filtered content

This allows me to process the original content if I find that something is vital, and showing the user my original html when editing. Obviously, I show filtered content wherever it appears on the site.

Answer 3

using Laravel, you may also need to sanitize the blade template files. You don’t want users to enter things like: {{{phpInfo ()}}}.

Building a WYSIWYG editor requires some level of trust from users. If you do not trust users, then your best option is what was mentioned earlier using custom tags.

Answer 4

I don’t know how possible this is for you, but one quick and easy solution is to use the httpOnly cookie. It resolves XSS attacks by injecting malicious javascript, as these cookies are not available for javascript. You can try to put senstive data in the httpOnly cookie and not so sensitive data in a regular cookie. See this: http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html