Maybe I'm missing something obvious here... The development landscape is littered with client-side WYSIWYG text editors (for example, TinyMCE), all of which seem to want to send raw HTML back to my server via something like a
textarea. The obvious challenge with a scheme like this is that, even if the editor can be trusted not to produce malicious HTML, it's trivial for a hacker to inject malicious HTML into a POST back to my website.
What am I missing? Does everyone who uses one of these client-side text editors attempt to "sanitize" the ingested HTML to remove malicious content? That would seem to be a losing game between the website and the bad guys, who are always coming up with creative constructs designed to elude HTML cleaners.
So, just thinking out loud here... For my project, I just need super-simple formatting (bold, italic, maybe bulleted lists). Some options for dealing with untrusted HTML-formatted text might be:
Somehow Cryptographically authenticate the HTML
The server could convert the ingested HTML to a "safe" format such as markdown. Presumably, the conversion process would be immune from attack because its output is a format that can be stored and later rehydrated to safe HTML for display on the website.
As at least one commenter has noted, it's possible to trick markdown into emitting malicious HTML. By extension, any rich text format that converts to HTML which is directly included in the web page is subject to a similar class of attacks. So my "convert the HTML to a 'safe' format" option is no better than simply trying to sanitize the uploaded HTML.
I would think that there should be some way to guarantee that all JS content is removed from the uploaded HTML. Obviously, browser engines recognize (and execute) sneaky JS. It should be easy enough to write some code that answers the question: "Is there any JS in this HTML snippet?" (Even better would be a
<iframe> elements. I wish...)