2

Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user.

A solution to stop these XSS vulnerabilities from craft docs is to "enable all “Purify HTML?” Rich Text field settings" but I've noticed this option only exists for Rich Text fields.

So my question is, is it somehow possible to activate "Purify HTML" on plain text fields (and other types of input like select and checkboxes)? Or do I need to escape/encode these fields on the client side (and how)?

Improve this question

1 Answer 1

Reset to default
1

The reason there is a "Purify HTML?" setting only for Rich Text fields is that Twig will automatically escape the output of every other field by default, mitigating XSS attack vectors.

Rich Text fields, by nature, are designed to store HTML, therefore their output isn't escaped and you have to rely on things like "Purify HTML?" (which uses http://htmlpurifier.org/) to try and remove anything malicious looking.

If you're plugin needs to output data for a Plain Text field in a way that doesn't get escaped (for whatever reason), you can always run HTMLPurifier on it manually.

Improve this answer
5
  • I'm a bit confused. If Twig automatically escapes the values of every other field.. then how did this XSS attack happen? Is it because the values aren't escaped on input and thus saved 'unescaped' in the database?
    – Jan Van Echelpoel
    Commented Dec 14, 2016 at 9:14
  • I've got no idea what your plugin is doing or how it's outputting that data, but all escaping is done on output, not input.
    – Brad Bell ♦
    Commented Dec 15, 2016 at 3:29
  • The plugin basically just shows data gathered by a form. This form has a textfield 'name'. The attacker entered all kinds of JavaScript like alert(123456) inside the 'name' textfield which caused the JS code/alert to be executed when I visited the plugin page where all the data is shown in the back-end. So why did the code execute if Twig automatically escapes the outputs of plain text fields?
    – Jan Van Echelpoel
    Commented Dec 15, 2016 at 8:36
  • Check the template where you're displaying the data on the plugin page. Maybe you're outputting it with |raw?
    – Brad Bell ♦
    Commented Dec 15, 2016 at 23:45
  • No just {{ a_variable }}.. Guess it's best to implement more checks on the entered values before putting it into sessionStorage, like html-encoding with jQuery.
    – Jan Van Echelpoel
    Commented Dec 16, 2016 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.