In my website I have a textbox where the user can enter whatever they want and the text is printed out on the next page. For certain cases, they can type HTML tags to format their message so that in the next page of the website things can be bolded, in a list, italicized, etc, but script tags are not allowed due to XSS vulnerabilities.
Right now I allow the
<a> tag to be reflected, so I can type into the textbox
<a href=https://google.ca>sample_link</a> and on the next page if the user clicks on the text
sample_link, they will be redirected to google.ca.
I have been reading up on whether you can get a virus from just visiting a website, and based on this answer here: Can you get virus just by visiting a website in Chrome? and many others, it seems you can. So say that the user didn't put google.ca, and instead some malicious url, then if they click that link their computer can get infected or some other attack may take place.
What I want to know is whether this is really an issue, since right now it seems like the only way for this to be a problem is if the user themselves enter this malicious link and click on it. So is there a way for an attacker to capitalize on the fact that this
<a> tag is being reflected? I guess one way is that if what someone enters in a textbox gets reflected in a page that everyone can see, then other users may click this link, but that would mean sites like stackoverflow and other forums would be "unsafe".
It would be great if someone could shed some light on this situation. Thanks in advance!
I have a whitelisted set of tags that are allowed to be reflected. Here they are:
"a", "b", "blockquote", "br", "cite", "code", "dd", "dl", "dt", "em", "i", "li", "ol", "p", "pre", "q", "small", "span", "strike", "strong", "sub", "sup", "u", "ul"