Escaping rich text editor output

Question

• When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?

Answer 1

The Content-Security Policy or CSP allows you to create a page of user controlled HTML that does not execute JavaScript, and therefore not XSS.

This is telling the browser not to execute JavaScript, which is a lot stronger than filtering the output, and using both will improve security. HTML filtering libraries such as HTMLPurifer, antisammy, safehtml, have all had numerous bypasses and therefore should not be used as the only means of defense. These are very complex filters, and complexity is the worst enemy of security.

Answer 2

The most important Things in this case is security. We want to give some HTML text from user or maybe by ourselves, then store it for exam in DB, then get it and show in webpages without fearing from any type of attack and misused by users with bad intention. I'v been researched about the best way to do that about 4 days and found 2 base ways. Please let me talk about other important thing that Many IDEs in web app development have some basic rules to prevent or warn about posting HTML that is the first trench against vulnerabilities. You have two way to pass this.

1) Encode HTML and post so IDE can't find any HTML Tag and will permit data to post, so you could save it and every time get it, Decode and use it. You could use prepared class and extensions or write your own. Below link is some examples in .Net environment or js/jQuery because of i'm .Net developer and sure exist same articles about other frameworks:

https://stackoverflow.com/questions/524528/asp-net-mvc-html-encode-new-lines

https://stackoverflow.com/questions/122641/how-can-i-decode-html-characters-in-c

https://stackoverflow.com/questions/1219860/html-encoding-in-javascript-jquery

and this is my own test about some js/jQuery functions can do that: http://jsfiddle.net/QMaster/4gz7yqcq/

2) Turn Off validation from one page or whole app, below link is about in .Net: http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx

But i suggest using AllowHTML attribute: http://msdn.microsoft.com/en-us/library/system.web.mvc.allowhtmlattribute(v=vs.118).aspx

And could read my answer: https://stackoverflow.com/questions/4759681/post-html-tag-codes-as-string-with-asp-net-mvc-jquery/25233054#25233054

Firstly i thought the best way is encode HTML and post, save and then decode as you can see in second way in top specialy in my answer, but then i think what if changes my rules about filtering and showing HTML tags. I don't know if encoding lost some things in given HTML. Except that i want just store html and the most important section of danger is when i get it back and write to response, so I decided to use Allow posting HTML just for special field by [AllowHTML] attribute. So i Get HTML as user write (I can do some limitation in tags same as many HTML Editors) and save it to DB. Now we have HTML and we need get it and show in page. This is the place attackers come. Any scrips in HTML can run, Frame can load and ... so what can we do? We should Sanitize HTML and that means clear it from dangerous parts. We could 1) Use some prepared tools to that same as:

https://gist.github.com/ntulip/814428 http://wpl.codeplex.com/ https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer

Or 2) Using some HTML Parser then remove every element suggested dangerous with Blacklist or whitelist. Some HTML Parser is exist with cons and pros you could search and compare them. I reached to Html Agility Pack in http://htmlagilitypack.codeplex.com/ and CsQuery in https://github.com/jamietre/csquery or paid awesomium in http://www.awesomium.com/

comparison of Html Agility Pack VS CsQuery is in http://blog.outsharked.com/2012/06/csquery-performance-vs-fizzler.html

After All I read This great article http://weblog.west-wind.com/posts/2012/Jul/19/NET-HTML-Sanitation-for-rich-HTML-Input and decided to parse HTML and sanitize with my own functions. For now i use HAP but i have plan to use CsQuery asap because of its performance.

Hope this help.