4

Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?

  • 2
    If you add the HTML filter to Full HTML, how is it different from the existing Filtered HTML input? – tim.plunkett Aug 3 '11 at 19:35
  • There's no difference? It just says it removes javascript and harmful stuff. Not sure – Matthew Hui Aug 3 '11 at 19:50
  • 2
    Then why wouldn't you just give them the Filtered HTML input? – tim.plunkett Aug 3 '11 at 19:58
  • 1
    I have some content written by an admin that seems to use the default input filter. I want it to use full html. – Matthew Hui Aug 3 '11 at 20:37
  • HtmlPurifier solved my problem – Matthew Hui Aug 3 '11 at 21:22
5

Only trusted roles and users should have access to Full HTML. You can add some additional allowed tags to the Filtered HTML input format but don't add too many or you risk creating a vulnerability. (admin/settings/filters)

  • Is it possible to allow inline css for allowed tags? – Matthew Hui Aug 3 '11 at 20:35
  • You can only add some additional allowed tags to filtered html and still keep it safe. Enabling "full html" for anonymous or putting too many (unsafe) tags into filtered html are two of the most common ways I've seen to make a site insecure. – greggles Aug 4 '11 at 15:20
  • To the question "is it possible to allow inline css" - no, Drupal does not have a good tool for filtering CSS to remove cross site scripting. – greggles Aug 4 '11 at 15:21
  • @glumbo There's a module for allowing/disallowing certain HTML tag attributes such as style (which is inline CSS): htmLawed. Just throwing it in here maybe it will be useful. – Beebee Aug 6 '12 at 8:27
5

It doesn't really matter what the name of the input format is, if "untrusted" users (see a defintion of trusted roles) are allowed to enter unsafe HTML tags then your site is unsafe.

You can make the Filtered HTML input format unsafe by adding the wrong tags to it or make the "Full HTML" input format more safe by changing its configuration.

I suggest installing the Security Review module and configuring it to know which roles of your site you trust. It will then analyze your input formats to see which are safe and which are not. It also has documentation and links to further resources if it determines that some of your input formats are unsafe. One great resource is the handbook page on configuring input formats for safety.

If you want to make a different input format the default for your admins vs. your regular users, try the Better Formats module.

protected by kiamlaluno Aug 6 '12 at 21:29

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.