Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user.

A solution to stop these XSS vulnerabilities from craft docs is to "enable all “Purify HTML?” Rich Text field settings" but I've noticed this option only exists for Rich Text fields.

So my question is, is it somehow possible to activate "Purify HTML" on plain text fields (and other types of input like select and checkboxes)? Or do I need to escape/encode these fields on the client side (and how)?


The reason there is a "Purify HTML?" setting only for Rich Text fields is that Twig will automatically escape the output of every other field by default, mitigating XSS attack vectors.

Rich Text fields, by nature, are designed to store HTML, therefore their output isn't escaped and you have to rely on things like "Purify HTML?" (which uses http://htmlpurifier.org/) to try and remove anything malicious looking.

If you're plugin needs to output data for a Plain Text field in a way that doesn't get escaped (for whatever reason), you can always run HTMLPurifier on it manually.

  • I'm a bit confused. If Twig automatically escapes the values of every other field.. then how did this XSS attack happen? Is it because the values aren't escaped on input and thus saved 'unescaped' in the database? Dec 14 '16 at 9:14
  • I've got no idea what your plugin is doing or how it's outputting that data, but all escaping is done on output, not input.
    – Brad Bell
    Dec 15 '16 at 3:29
  • The plugin basically just shows data gathered by a form. This form has a textfield 'name'. The attacker entered all kinds of JavaScript like alert(123456) inside the 'name' textfield which caused the JS code/alert to be executed when I visited the plugin page where all the data is shown in the back-end. So why did the code execute if Twig automatically escapes the outputs of plain text fields? Dec 15 '16 at 8:36
  • Check the template where you're displaying the data on the plugin page. Maybe you're outputting it with |raw?
    – Brad Bell
    Dec 15 '16 at 23:45
  • No just {{ a_variable }}.. Guess it's best to implement more checks on the entered values before putting it into sessionStorage, like html-encoding with jQuery. Dec 16 '16 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.