WMD editor sanitizing

Question

I am trying to find ways to sanitize the input of the WMD editor.

Specifically, I am trying to make HTML tags only available in the <code>tags that WMD generates. Is that possible

My problem is that the following code is rendered as HTML which is vunerable to potential XSS attacks.

For example, <a onmouseover="alert(1)" href="#">read this!</a>

The above code renders normally both in preview mode and when saved to the database.

I notice that Stack Overflow doesn't seem to have this problem. The same code is just rendered as text.

I notice that the Stack Overflow team has shared their code in http://refactormycode.com/codes/333-sanitize-html. Do I really have to use C# in order to sanitize WMD to do this?

Answer 1

I ended up using HTML Purifier for this.

Answer 2

If you want to block bad scripts from WMD on the client side, take a look at my answer here: Align the WMD editor's preview HTML with server-side HTML validation (e.g. no embedded JavaScript code).

It shows how to implement a client-side whitelist in the WMD editor to restrict WMD's preview pane HTML to known-safe HTML elements and known-safe HTML attributes. It does the validation after WMD geneates its HTML, so even if there's a bug in the WMD editor's HTML generation which allows bad script to get through, the whitelist blocker will catch it. This code is based on StackOverflow.com's implementation of the same validation.

That said, you also need server-side validation too (If you're using PHP, HTML Purifier is a good choice), because even if you fix the client, that doesn't prevent an attacker from simulating a browser and saving malicious markdown by POST-ing it to your server. So doing client-side WMD previewer validation isn't actually required, except to defend against an obscure case where an attacker manages to get compromised markdown onto the server, and convinces a site moderator to edit the page. In that case, client WMD previewer validation might prevent an attacker from taking over the entire site.

Also, doing client-side validation can be helpful because then you know that the same tags and HTML allowed by the client will also be allowed on the server. Make sure to sync the server-side whitelist with the client whitelist. StackOverflow's whitelist is here if you want an example.