I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building.

Since I expect my users to be entering confidential information into the editor it is crucial that it is as secure as possible.

Are there any WYSIWYG editors that have a particularly good reputation for security?

closed as off-topic by techraf, S.L. Barth, Xander, DKNUCKLES, schroeder Jul 21 '16 at 22:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • You know that such JS editors are only client-side? – deviantfan Jul 21 '16 at 0:21
  • 1
    Yes, of course. Then what kind of attack do you think of? If your server and/or other users can be attacked doesn't depend on the editor. (There are additional optional components like file managers etc. that need server-side stuff too, but I'm talking about the editor only here) – deviantfan Jul 21 '16 at 0:23
  • 1
    ...as another user says below too, there is no attack vector in the client-side part. (Sigh). A user doing stuff on his own computer, without communication with the server, is no server attack vector. – deviantfan Jul 21 '16 at 0:36
  • 1
    @user5508297 Can I get some clarification? The easiest, most effective way is to not accept HTML input from the user, and output encode. But with such a client-side editor, are you expecting HTML input from the user? – h4ckNinja Jul 21 '16 at 1:31
  • 1
    they are all the same. – dandavis Jul 22 '16 at 16:40

The problem isn't the WYSIWYG editor. They are clientside code. The problem with such editors is when they are integrated with the serverside to post content or perform an image upload.

Much of the bad reputation comes from when they are included in a CMS plugin. Those integrate with the serverside code base and either aren't always coded securely or the exploit is found in code unrelated to the WYSIWYG editor. Since the attack to the serverside originates from the WYSIWYG editor it gets the blame even though the same attack could of been done from a text area or a POST request to the vulnerable script.

Keep in mind they might provide tutorials for integrating with a serverside language. But these are just examples and shouldn't be used as production ready scripts. Unfortunately people take these scripts and run with them. So again, the blame gets put on the WYSIWYG editor despite the fault needing to be placed on a lazy developer.

Both of the editors you mentioned are pretty well maintained and you can't go wrong with either. However if you aren't using a CMS plugin the secure coding is up to you.

Edit: With the mention of XSS attacks on the clientside the same applies. Your serverside is pushing that data to the WYSIWYG editor. It expects whatever you send it is what you wish for it to display. Sanitation of malicious code needs to be done on your side before it is fed clientside.

Not the answer you're looking for? Browse other questions tagged or ask your own question.