WYSIWYG Rich text editor and renderer with no XSS risks

Question

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards compatible with plain text (to support existing text in our database), has simple rich-text formatting support (bold/italic/underline/bullets/blockquote/etc) and a frontend renderer that accepts the output and can display it, while not being able to introduce any HTML tags at all. This will greatly diminish the chance of XSS. I could not find any major project that does this.

We are currently implementing the following to evade XSS:

1. CSP
2. iframe sandbox
3. All important cookies are HttpOnly
4. Using a renderer that does now render scripts, like markdown-it or react-markdown.

That being said, it still feels like here is a major gap in the ecosystem. There is no editor + renderer that works with something like reStructedText or BBCode, or some other format with no support for HTML tags or advanced functionality. Most editors and renderers work with Markdown, which is problematic. We'd love something super simple that will allow basic features with a minimal amount of exposed surface.

Does anyone have any recommendations on how to tackle this challenge?

Answer 1

First of all - the use of the security mechanisms that you have described before is a good practice.

State-Of-The-Art XSS Sanitizers

DOMPurify

CURE53 (a leading group of security researches), created a client-side JS library that's called DOMPurify. You can use it as "sanitize(string)", that allows you to enter code and clean (sanitize) it, based on rules that you describe.

Caja

Caja is a similar tool from Google.

Both of Caja and DOMPurify are sanitizers only. However, they are super easy to use, and considered State-Of-The-Art in regards to HTML sanitation.

A Quick word about Iframes

Please keep in mind that using different domain (not only sub-domains) sandbox Iframe is a great practice, but not enough. Please beware of other pitfalls, such as using insecure window messages between the Iframes

A Quick word about CSP

I would like to encourage you to test your CSP in Google CSP evaluator (unless you are familiar with that already).