Why is letting HTML dangerous?

[Lea Verou]

I have read everywhere that letting a user post pure HTML is a site suicide.
I have accepted it for years as an axiom, like 1+1=2.
However, I've seen popular blogging sites to allow their bloggers to change the template by providing them its whole HTML, including <script> tags and everything!
Aren't they afraid? Have they taken any "special measures" to prevent abuse, and if so, what measures?

[Dismounted]

Yes, allowing HTML can let hackers inject malicious Javascript into a page, which could potentially steal people's cookie data.

[ablaye]

Originally Posted by Dismounted

Yes, allowing HTML can let hackers inject malicious Javascript into a page, which could potentially steal people's cookie data.

Can you provide an example???

[cheat-master30]

Originally Posted by Michelle

I have read everywhere that letting a user post pure HTML is a site suicide.
I have accepted it for years as an axiom, like 1+1=2.
However, I've seen popular blogging sites to allow their bloggers to change the template by providing them its whole HTML, including <script> tags and everything!
Aren't they afraid? Have they taken any "special measures" to prevent abuse, and if so, what measures?

1. They can use CSS and styling to disrupt the layout massively, or make parts of the login box or other features/links disappear from view.
2. As said, Javascript cookie stealing.
3. Javascript causes really annoying effects such as things flying around or maybe the page upside down/flipped.
4. Iframes to embed viruses and other malware.
5. Iframes or forms to embed fake forms for phishing purposes/stealing passwords, even making the fake form look part of the site.
6. Crashing the browser with an extremely large image.
7. Redirects to other, potentially dangerous/offensive pages.
8. Browser exploits.
9. Annoyances such as leaving tags open to turn everything bold under the empty tag or italic or underline etc...

[Dismounted]

Originally Posted by ablaye

Can you provide an example???

No, because then you'd go around trying to exploit forums...

[Lea Verou]

Originally Posted by cheat-master30

1. They can use CSS and styling to disrupt the layout massively, or make parts of the login box or other features/links disappear from view.
2. As said, Javascript cookie stealing.
3. Javascript causes really annoying effects such as things flying around or maybe the page upside down/flipped.
4. Iframes to embed viruses and other malware.
5. Iframes or forms to embed fake forms for phishing purposes/stealing passwords, even making the fake form look part of the site.
6. Crashing the browser with an extremely large image.
7. Redirects to other, potentially dangerous/offensive pages.
8. Browser exploits.
9. Annoyances such as leaving tags open to turn everything bold under the empty tag or italic or underline etc...

So, they can't harm the whole site, just the current page?
If so, then these blogging sites are not doing anything dangerous, each blog is its blogger's responsibility...

[Dismounted]

But your forum is your responsibility.

[Lea Verou]

Originally Posted by Dismounted

But your forum is your responsibility.

Definately.
But I'm going to add blogs to it, and I'm wondering if I should let them customize the whole html template or just the css. That's why I asked

[vertigo jones]

There's also things like that Myspace friends worm that happened early on over there.

Had some shit where there was some javascript embedded on someone's profile and then everyone who came to that page was added as a friend to that person AND it also copied itself to the viewing person's profile. Within a day or so the guy who started it was friends with everyone on Myspace. Something like that.

People can do weird, potentially dangerous things when they can stick whatever javascript they want on a page.

[Lea Verou]

So I'd better let them customize just the css?
Are there any exploits that someone can perform from css?
(We suppose that the code will strip html tags so that's not the case)