I am getting the following error in my security review: Untrusted users are allowed to input dangerous HTML tags.

Is this because in my text formats I've got the following: Plain text All roles may use this format

Should I disable anonymous users from being able to access plain text?

Also, it is saying: It is recommended you remove the following tags from roles accessible by untrusted users.


Should I remove the img tag from authenticated users???? Does this mean that authenticated users will not be able to uploaded images to their site at all?


Plain text is just that, no html tags, so this shouldn't be a security issue.

Perhaps the img tag is considered dangerous because it is possible to use a specially crafted png or jpg to launch an attack against a users browser.

| improve this answer | |
  • Thanks for that @MarkMuhleder . Any tips as to how to get rid of this error message "Untrusted users are allowed to input dangerous HTML tags." – kine456 Feb 11 '13 at 4:41
  • Does the module let you specify some roles as "trusted users"? – Mark Muhleder Feb 11 '13 at 12:19
  • I see that it does drupalcode.org/project/security_review.git/blob/refs/heads/… "Navigate to 39 Administer >> Reports >> Security Review >> Settings to mark which roles are 40 untrusted." – Mark Muhleder Feb 11 '13 at 12:21
  • Thank you!!! Having only the anonymous user set as untrusted user fixed the problem. – kine456 Feb 12 '13 at 0:12
  • It may "fix the problem" but is it the right thing to do? See drupalscout.com/knowledge-base/… – greggles Feb 12 '13 at 15:24

img tags are vulnerable to XSS attacks

Since my site required roles higher than authenticated to submit content, I simply unchecked "authenticated user" from admin/config/content/formats/filtered_html and that solved my audit report.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.