I am working on a chat program in my spare time. If a user inputs html it will be rendered, for example, <a href="example.com">link</a> will render a hyperlink. At the same time, if you use a script tag, the script doesn't seem to be executed, but is inserted into the dom. Should I be worried?

Edit: As I fixed the vulnerability, here's the site for anyone interested. wezelchat.herokuapp.com And the repo on github.

  • Yes. Yes, you should be. – thepip3r Oct 29 '18 at 19:43
  • Rendering alone isn't an issue (after all, this site does that for a small whitelist of HTML tags), but if you're actually seeing the script blocks in the DOM... that's very bad and basically guarantees XSS. – forest Oct 30 '18 at 3:14

Yes, it sounds like you should be worried.

I suggest you take a look at OWASP's very extensive XSS testing cheat sheet and see if you can get a popup on your site (indicating that you're vulnerable to XSS).

A good one to play with is inserting javascript into an image tag:

<img src="javascript:alert('XSS');">


<img src=doesnotexist onerror="alert('XSS')">

If you need users to be able to submit HTML then you should build an allow-list to decide which HTML tags (and which attributes within those tags) are loaded into the DOM, and everything else is rendered as text. This can get really tricky though, for example <img src="https://..."> might be ok, but <img src="javascript:..."> is not. This quickly becomes a game of whack-a-mole that the OWASP cheat sheet is likely to win.

At some point, it may be simpler to switch from having users submit HTML, to some kind of standard markdown library (like stackexchange or github does) so that you avoid the whole white-listing game altogether.

TL;DR: if you are allowing arbitrary HTML, then you probably have an XSS problem.

  • How would I prevent the rendering, would using a software library on the server side to replace special chars with their html char code be a good solution? – The_Bob Oct 29 '18 at 20:29
  • Good question. Doing html-escaping or applying whatever allow-list filtering on the server is a good idea. That said, I'm a pen-tester not a developer, so I'm better at breaking stuff and opening tickets than coming up with the fix. – Mike Ounsworth Oct 29 '18 at 20:38

I would advise against HTML. Unless you spend considerable time hardening your sever configuration (OWASP), HTML uploads are an invitation to abuse. Instead, you might consider a less powerful (and hence less security risk) language such as e.g. Markdown. They key point is that you have a much closer control over what the documents will contain.

  • 1
    Came here to add this but you beat me to it. Don't allow HTML, just allow a stripped down markup language that your backend systems convert to HTML. Much safer. – Conor Mancone Oct 31 '18 at 13:35
  • Yeah, I'll probably go with markup or no formatting. – The_Bob Nov 1 '18 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.