I am getting the following error in my security review: Untrusted users are allowed to input dangerous HTML tags.

Is this because in my text formats I've got the following: Plain text All roles may use this format

Should I disable anonymous users from being able to access plain text?

Also, it is saying: It is recommended you remove the following tags from roles accessible by untrusted users.


Should I remove the img tag from authenticated users???? Does this mean that authenticated users will not be able to uploaded images to their site at all?


2 Answers 2


Plain text is just that, no html tags, so this shouldn't be a security issue.

Perhaps the img tag is considered dangerous because it is possible to use a specially crafted png or jpg to launch an attack against a users browser.

  • Thanks for that @MarkMuhleder . Any tips as to how to get rid of this error message "Untrusted users are allowed to input dangerous HTML tags."
    – kine456
    Commented Feb 11, 2013 at 4:41
  • Does the module let you specify some roles as "trusted users"? Commented Feb 11, 2013 at 12:19
  • I see that it does drupalcode.org/project/security_review.git/blob/refs/heads/… "Navigate to 39 Administer >> Reports >> Security Review >> Settings to mark which roles are 40 untrusted." Commented Feb 11, 2013 at 12:21
  • Thank you!!! Having only the anonymous user set as untrusted user fixed the problem.
    – kine456
    Commented Feb 12, 2013 at 0:12
  • It may "fix the problem" but is it the right thing to do? See drupalscout.com/knowledge-base/…
    – greggles
    Commented Feb 12, 2013 at 15:24

img tags are vulnerable to XSS attacks

Since my site required roles higher than authenticated to submit content, I simply unchecked "authenticated user" from admin/config/content/formats/filtered_html and that solved my audit report.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.