Hi All,
I am currently building an auction website in coldfusion.
The user can input various things like location, title etc for their auction. One of the things that I am having a bit of trouble with, security-wise, is the BODY text.
So when they add their classified they have a textarea that they can type their body text into.
Now, having done a little bit of expermintation pasting different stuff in there, it seems that HTML is accepted as basically it just pastes the whole field (it is a TEXT type field in MSSQL server) straight into the final 'auction-detail' page that the user views.
There are several problems here as far as security goes, like I think i need to strip out certain tags. For example, if one puts in a <body bgcolor="black"> tag then the entire page has a black background and the text up the top cannot be read.
I was thinking their may be security flaws there as far as javascript goes as well. I imagine they could probably NOT pass coldfusion tags in as these would go in after the server has run through tags. Am i incorrect here? Could they put in CF tags and compromise security?
So, what is the best way to strip out the dangerous tags and what are the tags in question, while still allowing the user to pretty up their auction text a little?
On the other hand, i have been toying with the idea of making several buttons along the side of the textarea, [background colour], [text colour], [bold] [italics] etc etc and then just implementing these if the person selects text in the text area and clicks the button. This would be in some kind of language, just created for this purpose that would allow this stuff in the translation process to be turned into usable html.
Help and code would be great. Thanks for your time!
Cheers,
Brad
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I would allow only basic tags like bold or italic ( up to 4-5 ), as common user probally won't bother with other anyway...but it depends on the stucture of your page and the whole idea. In such case you wouldn't have problems with <script> tags... Just scan the string and remove everything with <> except for tags you want to allow.
cheers
here's a UDF that could help. just modify the badTags and badEvents list to suit your needs.
<cfscript>
/**
* Removes potentially nasty HTML text.
* Version 2 by Lena Aleksandrova - changes include fixing a bug w/ arguments and use of REreplace where REreplaceNoCase should have been used.
*
* @param text String to be modified. (Required)
* @param strip Boolean value (defaults to false) that determines if HTML should be stripped or just escaped out. (Optional)
* @param badTags A list of bad tags. Has a long default list. Consult source. (Optional)
* @param badEvents A list of bad HTML events. Has a long default list. Consult source. (Optional)
* @return Returns a string.
* @author Nathan Dintenfass (nathan@changemedia.com)
* @version 3, March 19, 2003
*/
function safetext(text) {
//default mode is "escape"
var mode = "escape";
//the things to strip out (badTags are HTML tags to strip and badEvents are intra-tag stuff to kill)
//you can change this list to suit your needs
var badTags = "SCRIPT,OBJECT,APPLET,EMBE
var badEvents = "bgcolor,onClick,onDblClic
var stripperRE = "";
//set up variable to parse and while we're at it trim white space
var theText = trim(text);
//find the first open bracket to start parsing
var obracket = find("<",theText);
//var for badTag
var badTag = "";
//var for the next start in the parse loop
var nextStart = "";
//if there is more than one argument and the second argument is boolean TRUE, we are stripping
if(arraylen(arguments) GT 1 AND isBoolean(arguments[2]) AND arguments[2]) mode = "strip";
if(arraylen(arguments) GT 2 and len(arguments[3])) badTags = arguments[3];
if(arraylen(arguments) GT 3 and len(arguments[4])) badEvents = arguments[4];
//the regular expression used to stip tags
stripperRE = "</?(" & listChangeDelims(badTags,"
//Deal with "smart quotes" and other "special" chars from MS Word
theText = replaceList(theText,chr(82
//if escaping, run through the code bracket by bracket and escape the bad tags.
if(mode is "escape"){
//go until no more open brackets to find
while(obracket){
//find the next instance of one of the bad tags
badTag = REFindNoCase(stripperRE,th
//if a bad tag is found, escape it
if(badTag.pos[1]){
theText = replace(theText,mid(TheTex
nextStart = badTag.pos[1] + badTag.len[1];
}
//if no bad tag is found, move on
else{
nextStart = obracket + 1;
}
//find the next open bracket
obracket = find("<",theText,nextStart
}
}
//if not escaping, assume stripping
else{
theText = REReplaceNoCase(theText,st
}
//now kill the bad "events" (intra tag text)
theText = REReplaceNoCase(theText,(L
//return theText
return theText;
}
</cfscript>
<cfset string = "<html><body bgcolor='black'>this is some <b>text</b> that I wrote.<br><script>window.a
<cfoutput>
#safetext(string)#
</cfoutput>
http://www.cfdev.com/activ
ActiveEdit is one of many rich ie editing tools. Specifically for allowing non-html html coding...
Or try this...
http://faq.ozoneasylum.com
one thing i just want to ask, is why are you worried about a user messing up thier own auction? my thought would be who cares? they paid for it, and they can make it unreadable if they want. its not like they'll be able to do anything that would harm a viewers computer.
but if you do care, i'd go with jyokums... that looks good to me.
Anand, thanks for the information on those tags, they allow you to submit exactly what the user types rather than HTML. This does take out the security problems but means that the user can't enter HTML.
jyokum, the code looks good and is a great way to take out bad tags. It is halfway to where i wanted to be.
Looking at
http://www.cfdev.com/activ
It looks pretty much like what I am looking for (with the exception that the cost is slightly prohibitive). It is the best of what is available along the lines of an html editor at the moment? Is there anything like this which is as good but cheaper or is this the best solution available?
It does also take out all code that is Non-HTML as well as dangerous tags inside html.
Thanks for all the different answers guys!
Cheers,
Brad
Usage would be something like
<cfoutput>
#pottyMouth(myString)#
</cfoutput>
<cfscript>
/**
* Searches for unwanted words and replaces them with a different string
* Original version by Jeff Yokum
*
* @param dirtyString The string to be searched. (required)
* @param wholeWords Matchs whole words only if set to true. Default is true (optional)
* @param ignoreCase Ignores case if set to true. Default is true (optional)
* @param replaceWith The character to use when replacing of the unwanted word. Default is **** (optional)
* @param wordList An optional comma delimited list of words to search for. This will replace the default list (optional)
* @return Returns a string.
* @author Jeff Yokum (jyokum<.AT.>yahoo<.DOT.>c
* @version 1, July 13, 2003
*/
function pottyMouth(dirtyString){
var wholeWords = true;
var ignoreCase = true;
var replaceWith = '****';
/*
* The only reason the word list is encrypted here is to protect the eyes
* of sensitive programmers or those who may stumble upon this code.
* When using this UDF, you can set wordList to the list of words you want
* to replace and the encryptedList variable can be removed.
*/
var encryptedList = '111C07581D11021A580A18060
var wordList = cfusion_decrypt(encryptedL
var pattern = "";
if(ArrayLen(arguments) gte 2) wholeWords = arguments[2];
if(ArrayLen(arguments) gte 3) ignoreCase = arguments[3];
if(ArrayLen(arguments) gte 4) replaceWith = arguments[4];
if(ArrayLen(arguments) gte 5) wordList = arguments[5];
pattern = "(" & ListChangeDelims(wordList,
if(wholeWords) pattern = "\b" & pattern & "\b";
if(ignoreCase) pattern = "(?i)" & pattern;
return REReplace(dirtyString,patt
}
</cfscript>
Thanks jyokum that looks excellent. I will definitely use it in the verification part of the site.
Please check here:
http://www.experts-exchang
Thanks again!
Brad
Business Accounts
Answer for Membership
by: anandkpPosted on 2003-07-04 at 02:30:31ID: 8855334
Hi Brad
pls copy & paste this file on ur machien & run it - let me know - if thats what ur looking for ?
<!--- Anand K Patel --->
<CFparam DEFAULT="" NAME="x">
<form name"frm" ACTION="x.cfm" METHOD="post">
<textarea name="x" ROWS="10" COLS="50" wrap="virtual">
type in ur text here with html & cf tags + type as much test u want here
so as to make it to "XX" chars & see what output u get
</TEXTAREA>
<INPUT TYPE="submit">
</FORM>
==========================
<BR>
from CFDOCS : Returns HTML escaped string. All carriage returns are removed from string, and all special characters (> < " &) are escaped.
all carriage returns are trimmed off automatically
<BR>
<CFOUTPUT>
<P><B>Output :</B>#HTMLEditFormat(x)#</
</CFOUTPUT>
==========================
Option -> carriage returns & special chars - taken care off automatically
<BR>
<CFOUTPUT>
<P><B>Output :</B>#HTMLCodeFormat(x)#</
</CFOUTPUT>
<BR>
K'Rgds
Anand