0

I'm currently working on an email template building website in PHP (LAMP to be specific) that allows users to paste in their HTML email code and then send it off to their customers.

Obviously with handling this kind of data I need to implement some kind of XSS security. I've scowled the net for weeks trying to find solutions to this and found very few good methods but they don't really work for full HTML documents (which is what I'd be dealing with).

These are the solutions I found and why they don't work for me:

HTMLPurifier:

I think this is the obvious choice for most because it's got the best security and is up to date with industry standards. Although it's main use is supposed to be for HTML fragements/small snippets, I thought I'd give it a go.

The first issue I ran into was that the head tags (and anything inside them) was getting stripped and removed. The head is quite essential in HTML emails so I had to find a way around this...unfortunately, the only fix I could find was to seperate the head from the rest of the email and run each part seperately though HTMLPurifier.

I've yet to try this because it seems very hacky but it seems to be the only way to achieve what I'm after. I'm also not sure on how well HTMLPurifier is at finding XSS in CSS. On top of all that, it doesn't do well in terms of performance with it being such a large library.

HTMLawed:

HTMLawed seemed to be another great option but a few things swayed me from using it.

A) Compared to HTMLPurifier, this seems to be less secure. HTMLawed has several documented security issues at the moment. It's also not widely used yet which is more worrying (only used by about 10 registered companies).

B) It's released under the GPL/GPU License, which effectively means I can't use it on my website unless I'm willing to let people use my service for free.

C) From what I've seen of people talking about it, it seems to strip a lot of tags unless it's heavily configured. I can't have much say here because I've not tried it but that also raises security concerns for me - what if I miss something? what if I can't configure it to keep the elements I want? etc.


These are my questions to you:

  1. Are there any better alternatives to the ones listed above?
  2. Is it possible to code this myself or is that too ambitious and too insecure?
  3. How do the larger email companies tackle this issue (mailchimp, activecampaign, sendinblue, etc.)?
3
  • are you using pure PHP or a framework like Laravel ?
    – ALPHA
    Nov 8, 2019 at 2:21
  • @THEWOLF pure PHP Nov 8, 2019 at 2:40
  • For your problem with HTML Purifier, this might help you: stackoverflow.com/a/41510846/245790 - though the answer is "it's possible, but it requires a lot of work". I personally think it would be worth it (and maybe clever googling will yield a github project where someone has done this for you), but YMMV. Good luck!
    – pinkgothic
    Nov 9, 2019 at 1:18

1 Answer 1

-2

It seem you are sending an HTML content. So then you cannot filter them. You must store HTML in your database. If you filter them using XSS proof, then the HTML will not working properly. By default, all Webmail service disabling Javascript by default like GMail, Yahoo, Roundcube etc.

If you are using WYSIWYG like CKEditor, it automatically remove all <script> tags and also certain unknown attribute. But still you can set it to what to accept and what to remove via CKEditor.config().

If you PHP cannot insert into your database because of some special chars, then you can use SQL prepare statement or encode your HTML input to base64 using base64_encode() then decode it when to use in mail() or PHPMailer::Body.

5
  • You've not understood my question my friend. Regardless of actually sending and encoding the html, I want to XSS proof it in the editor I have on my website. I know Google, Outlook and all the others do stop XSS attacks but I'm specifically talking about the times users will view the HTML on my website. Nov 8, 2019 at 2:43
  • @FatDude22222 what kind XSS attack you want to avoid? Try using CKEditor or tinyMCE editor, it will remove <script> tags and <iframe>. If you want to view the HTML content, the hard to XSS proof on it. But if you want to show the HTML code, then try using htmlenitites() function when echo-ing it in your editor.
    – Mr Hery
    Nov 8, 2019 at 3:08
  • You should have put some codes in your question. And sample input, and expected output.
    – Mr Hery
    Nov 8, 2019 at 3:08
  • 1) All XSS attacks, there's none I'm okaying with happening. 2) Simply relying on a client-side script to deal with XSS is extremely bad practice, it should be done server-side. 3) "If you want to view the HTML content, the hard to XSS proof on it" - I know, thats why I'm here. 4) htmlenitites() is useless here. With HTML you don't want to escape every single none alphabetical character. 5) HTML is all the same in regards to my question. As I said in my OQ, it's a full HTML email, the contents of said HTML email doesn't really matter to answer my question. Nov 8, 2019 at 3:25
  • As for your information, putting <h1> tags is counted as XSS attack. If you want to avoid that <h1> too, then you can use htmlspecialchars() function. But this will make your HTML cannot be viewed. Put some codes and expected output value. Client side filter is not good. We noticed that. Try PHP HTML DOM Document class. It can remove certain tag that you want to avoid from server side before storing your HTML into database.
    – Mr Hery
    Nov 8, 2019 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.