2

I'd like to show a text with HTML execution (formated) in the browser so it will be easy to read BUT without any JavaScript execution. It's a large text and it's very hard to read between HTML tags. So, execute HTML but not JavaScript.

What I did: I loaded this text in an <iframe> so I can have full control and I tried to show the text like this:

<script>
throw new Error('This is just to abort javascript');
</script>
<?php echo $text ?>
<script>
throw new Error('This is just to abort javascript');
</script>

The console does show an error but even so, if I have $text = '<script>alert(1)</script>'; this script gets executed anyway.

Another XSS example that I'd like to avoid. $text = '<a href="#" onmouseover="alert(1)">this is a fake url</a>';

Basically, abort any JavaScript execution from the page.

Thanks in advance!

4
  • Do you want to totally remove any JS scripts in $text, or do you want them to be displayed as text in the iframe without executing?
    – Ben Cook
    Aug 14, 2015 at 13:21
  • You can't disable javascript execution just for a certain area of the code. Only for the whole page (and also only by hand in your browser settings). I'm afraid you wount get around filtering scripts out or escape it.
    – Benjamin
    Aug 14, 2015 at 13:24
  • Another xss vulnerability to be aware of which may break plans of filtering out anything that's not 'href'... <a href="javascript:alert(1);void(0);">I'm totally legit, click me.</a>
    – samlev
    Aug 14, 2015 at 13:29
  • @blcook223 - the idea is to stop executing any JavaScript code, not only <script> tags. As @samlev say, there is href="javascript: and also we can have events (onmouse..., onload and many others). So, "parse the text and remove scripts" is not a solution. I need to force the browser to abort/stop any scripts. I got my solution: cannot be done :) Thank you all! Aug 17, 2015 at 7:24

2 Answers 2

3

Unfortunately this isn't really possible. The reason that that doesn't work is because the error stops that script from executing, but doesn't stop all scripts on the page from executing.

If you're trusting HTML input from the user, you're simply going to have XSS vulnerabilities, unless you try to parse their input and remove anything that could cause a javascript event to fire. Don't try this, you're in for a lot of heartache if you do.

Ultimately, this is why things like MarkDown and Textile exist.

I guess the answer to "what you should do" depends on what you're expecting the user to actually send you, but ultimately you should be running any user input through htmlentities and/or strip_tags

1
  • I posted the question hoping that someone knows some magic :) Thank you also for MarkDown and Textile links. Aug 17, 2015 at 7:48
1

You can specify a Content Security Policy to prevent any inline JavaScript from executing.

See here for browser compatibility.

It is also recommended to run any user input through an HTML sanitizer too, as this will help protect browsers without CSP support. Using BBcode or something like MarkDown is also recommended, rather than allowing users to enter raw HTML as this is much simpler (and complexity is the enemy of security).

6
  • Cool stuff! I did not know about this header. BBCode is not an option. The client must be able to copy-paste some HTML into our platform and we must read the content. Is there workaround for IE? (God, I hate Microsoft so much for this browser!) Aug 17, 2015 at 9:58
  • I believe the partial support provided is enough to prevent scripting. Using this with an established HTML sanitizer would usually be adequate (please don't try and write your own, it's complicated!). Aug 17, 2015 at 10:01
  • IE does not know about this header. I tried header("Content-Security-Policy: default-src 'none'"); and header("X-Content-Security-Policy: default-src 'none'"); and header("X-Webkit-CSP: default-src 'none'"); On Firefox it's OK, IE does not react in any way. Aug 17, 2015 at 10:50
  • It should do (IE 10 +). Aug 17, 2015 at 10:52
  • I know, caniuse.com also says that it should. Maybe I'm doing something wrong. I have IE11 on Windows8.1. I tried default-src 'none' and also default-src not.valid.website.here. Same old story: on Firefox/Chhrome it's OK, on IE it's not. Aug 17, 2015 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.