How to prevent Cross Site Scripting when input using "Full HTML" mode of CKEditor

Question

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following:

In the detail page, I can see that the script in onmouseover="alert('222222')" is executed when I move my mouse over the "click" text.

Hacker can easily add a malicious script by this way. How can we avoid this ?

Issue is not only for "Full HTML" mode, but also other modes if we configure a proxy between browser and server to change the encoded value to the raw value.

For example, if we select the "Unfiltered HTML" mode and we input <a href="#" onmouseover="alert('111111')">click</a> to the body field. When we save the page, the body value will be sent with a POST request that it is HTML encoded: <a href="#" onmouseover="alert('111111')">click</a>. But in the proxy above, we configure to change the encoded value to the raw value. Then the raw value <a href="#" onmouseover="alert('111111')">click</a> is saved into DB which will cause the same issue with "Full HTML" mode.

A solution that we can encode the output in theme preprocessing hook. But it seems require us to add a lot of codes because our system may have many entity types and fields.

Answer 1

See the documentation:

Finally, it should be obvious that the Full HTML input format, which does not use the HTML Filter, is insecure and should be offered only to those users who can be trusted not to ruin your site. Most sites will be better off deleting this input format.

https://www.drupal.org/node/213156

---

"A solution that we can encode the output in theme preprocessing hook. But it seems require us to add a lot of codes because our system may have many entity types and fields."

Don't do this in preprocessing. You can configure your own safe text format containing as many text filters as you want. If the built in text filters don't provide the security you need then add a custom filter.

---

Core ships with Full HTML so that site owners are able to create basic pages in CKEditor using almost all HTML features, which they can do anyway when they have access to the template files.