0

I want to filter user-input on my site and enable only <iframe> tag, which users will be able to use to add video in their posts (like youtube and vimeo).

My first idea was to use strip_tags() and enable <iframe> tag in it. But later i read an article about this function here: Article on Reddit

So I think that it's a bad idea to use it cause you can get XSS.

How can I solve this problem ?

UPDATE: I want a solution that won't be an overkill in this case.

2 Answers 2

1

Maybe instead of allowing people to post HTML, you could search the input for things that might be links to YouTube videos, and then splice in the code yourself.

I found this code on StackOverflow earlier today: How do I find all YouTube video ids in a string using a regex?

It searches a string for YouTube URLs, and replaces them with links. Below is a modified version of the code that replaces the URLs with <iframe/>s

// Linkify youtube URLs which are not already links.
// From https://stackoverflow.com/questions/5830387/php-regex-find-all-youtube-video-ids-in-string
function linkifyYouTubeURLs($text) {
    $text = preg_replace('~
        # Match non-linked youtube URL in the wild. (Rev:20111012)
        https?://         # Required scheme. Either http or https.
        (?:[0-9A-Z-]+\.)? # Optional subdomain.
        (?:               # Group host alternatives.
          youtu\.be/      # Either youtu.be,
        | youtube\.com    # or youtube.com followed by
          \S*             # Allow anything up to VIDEO_ID,
          [^\w\-\s]       # but char before ID is non-ID char.
        )                 # End host alternatives.
        ([\w\-]{11})      # $1: VIDEO_ID is exactly 11 chars.
        (?=[^\w\-]|$)     # Assert next char is non-ID or EOS.
        [?=&+%\w-]*        # Consume any URL (query) remainder.
        ~ix', 
        '

<iframe width="560" height="315" src="http://www.youtube.com/embed/$1"></iframe>

',
        $text);
    return $text;
}

You could implement it like this:

<?php
$text = 'This is my comment. It contains an XSS attack!:
<script type="text/javascript">
    alert(\'bam\');
</script>

I learned about XSS on YouTube:
http://www.youtube.com/watch?v=i38LMZyKIqI
';

//  Sanitize XSS (e.g.: convert '<' to '&lt;')
$output = htmlspecialchars($text);

$pattern = [];

$output = linkifyYouTubeURLs($output);

//  Add natural line breaks
$output = nl2br($output);

echo $output;

?>

XSS attacks are stopped, but the YouTube links get converted into videos. You could probably modify it further to work with Vimeo and the other major video providers.

Here is the code in action:

http://codepad.viper-7.com/8w0h1F

0

You could try this:

$out = preg_replace("#<(?!/?iframe[ >])#i","&lt;",$in);

However keep in mind that a user could put event handlers on the iframe tag to cause some kind of XSS.

1
  • Yes, i can do this. But i want to prevent any xss:) Sep 13, 2012 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.