Code injection in ckeditor

Hi !
I have tested to put some code javascript and php in the content of the ckeditor's textarea, and i discovered that it wasn't purified :
Examples : attributes like onclick, the tags <script> and <?php ?> etc.
I bet it's very risky to let my website's users to post code in the editor
So how can I circumvent this problem ?
Thank's

Sun, 08/07/2011 - 09:13

alfonsoml

Joined: 31/12/2006

Posts: 3737

Re: Code injection in ckeditor

You must perform those checks at the server. An attacker will bypass any javascript check

Sun, 08/07/2011 - 11:58

simohammed

Joined: 07/08/2011

Posts: 6

Re: Code injection in ckeditor

Thank you for your reply
I've found a ceertain package named htmlpurifier
do you think that it is sufficient to secure the content of the editor before inserting it in the database ?

Sun, 08/07/2011 - 12:27

alfonsoml

Joined: 31/12/2006

Posts: 3737

Re: Code injection in ckeditor

It just depends on how you use it.
You have to perform tests, check their recomendations, how do they affect the content, understand the options of that purifier and CKEditor and why you want to allow to use CKEditor for people that you don't trust...