vb.org Archive
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Programming Articles (https://vborg.vbsupport.ru/forumdisplay.php?f=188)
-   -   Reasons never to allow HTML (https://vborg.vbsupport.ru/showthread.php?t=68184)

CarCdr 08-09-2004 10:00 PM
Reasons never to allow HTML
 
This was written in response to various queries regarding the use of HTML, most recently in this thread.
-----------------

In general, one is probably fine allowing bbcodes, although I do not know if bbcodes like IMG and URL are safe. (See below.)

While vB provides the capability to allow HTML, one should never use it. It opens your board to attack.

Use bbcodes. If you need to emulate an HTML tag, write a new bbcode.

The problem with allowing the injection of HTML is a complicated one. There is no 100% safe method to allow HTML and feel secure. Some of the issues and interactions are:

1. The obviously dangerous tags like SCRIPT and APPLET are not the only danger. Any injection of a URL can be dangerous. Any tag that allows for a URL (e.g., a, img, frame, ...) can be used for cross-site scripting and cookie stealing, which can allow someone to hack into your board.

2. Hackers can use various tricks that would result in a tag getting through the filter imposed by the PHP checker. Possible examples:
a) <sc\0ript> becomes <script>
b) <scr<embed>ipt> becomes <embed> or <script>

3. Then there is the issue of malicious tag attributes and events such as onclick and onmouseup.

--------
Potentially dangerous tags that accept URL's:
A, APPLET, AREA, BASE, BGSOUND, BODY, EMBED, FORM, FRAME, IFRAME, ILAYER, IMG, ISINDEX, INPUT, LAYER, LINK, OBJECT, SCRIPT, SOUND, TABLE, TD, TH, TR

Dean C 08-10-2004 11:11 AM
I'll move this over to modifications hints and tips - I think we need a rename of that forum :)

Natch 08-10-2004 10:19 PM
Handy Hints 4 Board Admins?

deathemperor 08-10-2004 11:52 PM
good hints
HTML is magic.

Gutspiller 08-17-2005 09:41 PM
Or you can just censor certain html tags and be a little safer:

Code:
<style </style <iframe </iframe <link </link <basefont </basefont <base </base <th </th <tfoot </tfoot <tbody </tbody <thead </thead <body </body <meta </meta <script </script <html </html <plaintext </plaintext <xmp </xmp <object <noframes <noembed <noscript <nojava onload onMouseover <fieldset :absolute style="position "position absolute; <caption onMouseOut view-source
:ermm:

Zachery 08-17-2005 09:44 PM
Quote:
Originally Posted by Gutspiller
Or you can just censor certain html tags and be a little safer:

Code:
<style </style <iframe </iframe <link </link <basefont </basefont <base </base <th </th <tfoot </tfoot <tbody </tbody <thead </thead <body </body <meta </meta <script </script <html </html <plaintext </plaintext <xmp </xmp <object <noframes <noembed <noscript <nojava onload onMouseover <fieldset :absolute style="position "position absolute; <caption onMouseOut view-source
:ermm:
Censor is really easy to get around :)

FrozenCreations 08-24-2005 10:54 PM
i have an even better reason /;

do not alow <img /> tags!!

<HTML>
<BODY>
<IMG SRC="./bsod.gif" width="9999999"height="9999999" />
</BODY>
</HTML>

INSTANT DOOM!! muahahahahahaha

(it chrashes the page ;)

AN-net 08-25-2005 05:23 AM
Quote:
Originally Posted by Gutspiller
Or you can just censor certain html tags and be a little safer:

Code:
<style </style <iframe </iframe <link </link <basefont </basefont <base </base <th </th <tfoot </tfoot <tbody </tbody <thead </thead <body </body <meta </meta <script </script <html </html <plaintext </plaintext <xmp </xmp <object <noframes <noembed <noscript <nojava onload onMouseover <fieldset :absolute style="position "position absolute; <caption onMouseOut view-source
:ermm:
there are still so many more possibilities to use vicious javascript and code

FrozenCreations 08-25-2005 08:14 PM
and theres always my instant doom img tag :)

the downside is, you gota upload your own pic /;

Tradjick 09-28-2005 03:17 AM
And when enabling HTML only for Admins, would that be safe, beside the risk that someone gets Admin access?


All times are GMT. The time now is 08:53 AM.
Page 1 of 2 1 2
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01261 seconds
  • Memory Usage 1,736KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (3)bbcode_code_printable
  • (2)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (10)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete