0

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: Page creation

In the detail page, I can see that the script in onmouseover="alert('222222')" is executed when I move my mouse over the "click" text.

Page detail

Hacker can easily add a malicious script by this way. How can we avoid this ?

Issue is not only for "Full HTML" mode, but also other modes if we configure a proxy between browser and server to change the encoded value to the raw value.

For example, if we select the "Unfiltered HTML" mode and we input <a href="#" onmouseover="alert('111111')">click</a> to the body field. When we save the page, the body value will be sent with a POST request that it is HTML encoded: &lt;a href=&quot;#&quot; onmouseover=&quot;alert(&#39;111111&#39;)&quot;&gt;click&lt;/a&gt;. But in the proxy above, we configure to change the encoded value to the raw value. Then the raw value <a href="#" onmouseover="alert('111111')">click</a> is saved into DB which will cause the same issue with "Full HTML" mode.

A solution that we can encode the output in theme preprocessing hook. But it seems require us to add a lot of codes because our system may have many entity types and fields.

3

See the documentation:

Finally, it should be obvious that the Full HTML input format, which does not use the HTML Filter, is insecure and should be offered only to those users who can be trusted not to ruin your site. Most sites will be better off deleting this input format.

https://www.drupal.org/node/213156


"A solution that we can encode the output in theme preprocessing hook. But it seems require us to add a lot of codes because our system may have many entity types and fields."

Don't do this in preprocessing. You can configure your own safe text format containing as many text filters as you want. If the built in text filters don't provide the security you need then add a custom filter.


Core ships with Full HTML so that site owners are able to create basic pages in CKEditor using almost all HTML features, which they can do anyway when they have access to the template files.

  • It’s weird that core ships with Full HTML, but then the docs like that say to delete it. – Kevin Apr 19 at 12:20
  • @4k4, I think Drupal core should have filters or input formats that prevent malicious scripts as example I gave in the question ? This is a very common issue, I think. – Tai Nguyen Apr 19 at 12:28
  • Out of the box this is safe, the Full HTML text format is restricted to the Administrator role. – 4k4 Apr 19 at 15:56
  • How can I apply HTML Filter for my html formated field when I customize the display using twig template? – Tai Nguyen Apr 22 at 5:06
  • I don't understand how this is connected to Twig. In a standard install authenticated users can only use Basic HTML and anonymous Restricted HTML. Both text formats include the HTML Filter, with more (for authenticated) or less (for anonymous) allowed HTML Tags.. – 4k4 Apr 22 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.