I developed a web application, that permits my users to manage some aspects of a web site dynamically (yes, some kind of cms) in LAMP environment (debian, apache, php, mysql)
我开发了一个Web应用程序,允许我的用户在LAMP环境中动态管理网站的某些方面(是的,某种cms)(debian,apache,php,mysql)
Well, for example, they create a news in their private area on my server, then this is published on their website via a cURL request (or by ajax).
好吧,例如,他们在我的服务器上的私人区域创建新闻,然后通过cURL请求(或通过ajax)在他们的网站上发布。
The news is created with an WYSIWYG editor (fck at moment, probably tinyMCE in the next future).
这个消息是用WYSIWYG编辑器创建的(fck at moment,可能是未来的tinyMCE)。
So, i can't disallow the html tags, but how can i be safe? What kind of tags i MUST delete (javascripts?)? That in meaning to be server-safe.. but how to be 'legally' safe? If an user use my application to make xss, can i be have some legal troubles?
所以,我不能禁止html标签,但我怎么能安全?我必须删除什么样的标签(javascripts?)?这意味着服务器安全..但如何“合法”安全?如果用户使用我的应用程序制作xss,我可以遇到一些法律问题吗?
10 个解决方案
#1
15
If you are using php, an excellent solution is to use HTMLPurifier. It has many options to filter out bad stuff, and as a side effect, guarantees well formed html output. I use it to view spam which can be a hostile environment.
如果你使用的是php,一个很好的解决方案就是使用HTMLPurifier。它有很多选项可以过滤掉不好的东西,作为副作用,可以保证形成良好的html输出。我用它来查看可能是恶劣环境的垃圾邮件。
#2
11
It doesn't really matter what you're looking to remove, someone will always find a way to get around it. As a reference take a look at this XSS Cheat Sheet.
你要删除的内容并不重要,有人会总能找到解决问题的方法。作为参考,请看一下这个XSS备忘单。
As an example, how are you ever going to remove this valid XSS attack:
例如,您将如何删除此有效的XSS攻击:
<IMG SRC=javascript:alert('XSS')>
Your best option is only allow a subset of acceptable tags and remove anything else. This practice is know as White Listing and is the best method for preventing XSS (besides disallowing HTML.)
您最好的选择是只允许可接受标签的子集并删除其他任何内容。这种做法被称为白名单,是防止XSS的最佳方法(除了不允许使用HTML)。
Also use the cheat sheet in your testing; fire as much as you can at your website and try to find some ways to perform XSS.
在测试中也使用备忘单;在您的网站上尽可能多地开火,并尝试找到一些方法来执行XSS。
#3
6
The general best strategy here is to whitelist specific tags and attributes that you deem safe, and escape/remove everything else. For example, a sensible whitelist might be <p>, <ul>, <ol>, <li>, <strong>, <em>, <pre>, <code>, <blockquote>, <cite>. Alternatively, consider human-friendly markup like Textile or Markdown that can be easily converted into safe HTML.
这里的一般最佳策略是将您认为安全的特定标签和属性列入白名单,并转义/删除其他所有内容。例如,合理的白名单可能是
,
-
,
-
,
- ,,,
,
,, 。或者,考虑像Textile或Markdown这样的人性化标记,可以轻松转换为安全的HTML。
,,, ,,,。或者,考虑像Textile或Markdown这样的人性化标记,可以轻松转换为安全的HTML。
#4
2
Rather than allow HTML, you should have some other markup that can be converted to HTML. Trying to strip out rogue HTML from user input is nearly impossible, for example
您应该拥有一些可以转换为HTML的其他标记,而不是允许HTML。例如,试图从用户输入中删除流氓HTML几乎是不可能的
<scr<script>ipt etc="...">
Removing from this will leave
从中删除将离开
<script etc="...">
#5
#6
1
Kohana's security helper is pretty good. From what I remember, it was taken from a different project.
Kohana的安全助手非常好。从我记忆中,它来自一个不同的项目。
However I tested out
但是我测试了
<IMG SRC=javascript:alert('XSS')>
From LFSR Consulting's answer, and it escaped it correctly.
来自LFSR Consulting的答案,它正确地逃脱了。
#7
0
If it is too difficult removing the tags you could reject the whole html-data until the user enters a valid one. I would reject html if it contains the following tags:
如果删除标签太困难,您可以拒绝整个html数据,直到用户输入有效的数据。如果它包含以下标记,我会拒绝html:
frameset,frame,iframe,script,object,embed,applet.
Also tags which you want to disallow are: head (and sub-tags),body,html because you want to provide them by yourself and you do not want the user to manipulate your metadata.
您还想要禁用的标签是:head(和子标签),body,html,因为您希望自己提供这些标签,并且您不希望用户操纵您的元数据。
But generally speaking, allowing the user to provide his own html code always imposes some security issues.
但一般来说,允许用户提供自己的HTML代码总是会带来一些安全问题。
#8
0
You might want to consider, rather than allowing HTML at all, implementing some standin for HTML like BBCode or Markdown.
你可能想要考虑,而不是允许HTML,实现像BBCode或Markdown这样的HTML。
#9
0
I use this php strip_tags function because i want user can post safely and i allow just few tags which can be used in post in this way nobody can hack your website through script injection so i think strip_tags is best option
我使用这个php strip_tags函数,因为我希望用户可以安全发布,我允许只有几个标签可以在帖子中使用这种方式没有人可以通过脚本注入破解你的网站所以我认为strip_tags是最好的选择
Clich here for code for this php function
在这里陈词滥调这个PHP函数的代码
#10
-1
It is very good function in php you can use it
它是非常好的功能在PHP你可以使用它
$string = strip_tags($_POST['comment'], "<b>");
#1
15
If you are using php, an excellent solution is to use HTMLPurifier. It has many options to filter out bad stuff, and as a side effect, guarantees well formed html output. I use it to view spam which can be a hostile environment.
如果你使用的是php,一个很好的解决方案就是使用HTMLPurifier。它有很多选项可以过滤掉不好的东西,作为副作用,可以保证形成良好的html输出。我用它来查看可能是恶劣环境的垃圾邮件。
#2
11
It doesn't really matter what you're looking to remove, someone will always find a way to get around it. As a reference take a look at this XSS Cheat Sheet.
你要删除的内容并不重要,有人会总能找到解决问题的方法。作为参考,请看一下这个XSS备忘单。
As an example, how are you ever going to remove this valid XSS attack:
例如,您将如何删除此有效的XSS攻击:
<IMG SRC=javascript:alert('XSS')>
Your best option is only allow a subset of acceptable tags and remove anything else. This practice is know as White Listing and is the best method for preventing XSS (besides disallowing HTML.)
您最好的选择是只允许可接受标签的子集并删除其他任何内容。这种做法被称为白名单,是防止XSS的最佳方法(除了不允许使用HTML)。
Also use the cheat sheet in your testing; fire as much as you can at your website and try to find some ways to perform XSS.
在测试中也使用备忘单;在您的网站上尽可能多地开火,并尝试找到一些方法来执行XSS。
#3
6
The general best strategy here is to whitelist specific tags and attributes that you deem safe, and escape/remove everything else. For example, a sensible whitelist might be <p>, <ul>, <ol>, <li>, <strong>, <em>, <pre>, <code>, <blockquote>, <cite>. Alternatively, consider human-friendly markup like Textile or Markdown that can be easily converted into safe HTML.
这里的一般最佳策略是将您认为安全的特定标签和属性列入白名单,并转义/删除其他所有内容。例如,合理的白名单可能是
,
-
,
-
,
- ,,,
,
,, 。或者,考虑像Textile或Markdown这样的人性化标记,可以轻松转换为安全的HTML。
,,, ,,,。或者,考虑像Textile或Markdown这样的人性化标记,可以轻松转换为安全的HTML。
#4
2
Rather than allow HTML, you should have some other markup that can be converted to HTML. Trying to strip out rogue HTML from user input is nearly impossible, for example
您应该拥有一些可以转换为HTML的其他标记,而不是允许HTML。例如,试图从用户输入中删除流氓HTML几乎是不可能的
<scr<script>ipt etc="...">
Removing from this will leave
从中删除将离开
<script etc="...">
#5
2
For a C# example of white list approach, which * uses, you can look at this page.
对于*使用的白名单方法的C#示例,您可以查看此页面。
#6
1
Kohana's security helper is pretty good. From what I remember, it was taken from a different project.
Kohana的安全助手非常好。从我记忆中,它来自一个不同的项目。
However I tested out
但是我测试了
<IMG SRC=javascript:alert('XSS')>
From LFSR Consulting's answer, and it escaped it correctly.
来自LFSR Consulting的答案,它正确地逃脱了。
#7
0
If it is too difficult removing the tags you could reject the whole html-data until the user enters a valid one. I would reject html if it contains the following tags:
如果删除标签太困难,您可以拒绝整个html数据,直到用户输入有效的数据。如果它包含以下标记,我会拒绝html:
frameset,frame,iframe,script,object,embed,applet.
Also tags which you want to disallow are: head (and sub-tags),body,html because you want to provide them by yourself and you do not want the user to manipulate your metadata.
您还想要禁用的标签是:head(和子标签),body,html,因为您希望自己提供这些标签,并且您不希望用户操纵您的元数据。
But generally speaking, allowing the user to provide his own html code always imposes some security issues.
但一般来说,允许用户提供自己的HTML代码总是会带来一些安全问题。
#8
0
You might want to consider, rather than allowing HTML at all, implementing some standin for HTML like BBCode or Markdown.
你可能想要考虑,而不是允许HTML,实现像BBCode或Markdown这样的HTML。
#9
0
I use this php strip_tags function because i want user can post safely and i allow just few tags which can be used in post in this way nobody can hack your website through script injection so i think strip_tags is best option
我使用这个php strip_tags函数,因为我希望用户可以安全发布,我允许只有几个标签可以在帖子中使用这种方式没有人可以通过脚本注入破解你的网站所以我认为strip_tags是最好的选择
Clich here for code for this php function
在这里陈词滥调这个PHP函数的代码
#10
-1
It is very good function in php you can use it
它是非常好的功能在PHP你可以使用它
$string = strip_tags($_POST['comment'], "<b>");