Why are my Font & Colors being stripped from Wygwam when I post through Safecracker?

Question

I'm running into an issue with Wygwam and Safecracker. When I extend the Wygwam configuration for a field (such as adding font-color) and then use that option on my field in Safecracker, the HTML seems to be getting stripped out like so:

Instead of this:

<p>
<span style="color:#ff0000;"><span style="font-size:16px;"><span style="font-family:georgia,serif;">Why aren&#39;t you saving???</span></span></span></p>

I get this (after submit):

<p>
<span><span>&lt;span new,courier,monospace;&quot;=&quot;&quot;&gt;Why aren&#39;t you saving???</span></span></p>

I'm sure this is due to XSS filtering in Safecracker, are there any good solutions to get around this issue? I'm using 2.6.3 of Wygwam and EE 2.5.3 (Safecracker 2.1).

Answer 1

Take a look around line 1281 of system/expressionengine/modules/safecracker/libraries/safecracker_lib.php, you will see this:

//@TODO what to do about xss_clean and "naughty" html
//for now you can crack open this file and manually add fields_ids and/or field types to the respective arrays
//to prevent xss_clean
//i had some people complain about not being able to submit <object>'s
$xss_clean = ( ! in_array($field['field_id'], $this->skip_xss_field_ids) && ! in_array($field['field_type'], $this->skip_xss_fieldtypes));

This array seems to be here specifically to help with your situation (wanting to skip XSS filtering on safecracker fields).

The array is initialized around line 2612 of the same file:

$this->skip_xss_field_ids = array();

Therefore, you should simply be able to add your field IDs to this array, to skip XSS filtering, like so:

$this->skip_xss_field_ids = array(37, 81);

Keep in mind this is a REALLY REALLY BAD IDEA. At this point, users can now add any arbitrary javascript to their wygwam field, and you have effectively opened your website up to XSS attacks (malicious users could hijack other users' sessions and do whatever they like).

Answer 2

Everything Adrian says is right. However, if you are not allowing guests to post via this form and it's only for approved, registered users, the XSS threat is mitigated. In fact, when you submit an entry in the CP, fields are NOT passed to the XSS filter.

Answer 3

If you have the "removeFormatAttributes" setting applied to your Wygwam configuration it will strip out style attributes (amongst others).

Go to Add-ons -> Modules -> Wygwam and click on the config set you are using for the field in question. From there you can select various settings to affect how that set works.