0

I use jQuery redactorjs for my form to let my users type formatted beautiful text. But after browsing stackoverflow I found some answers from users that I should never accept preformatted input. Here is the question link.

I want my website to be secure, so will this make my website less secure if I use this jquery plugin?

Community
  • 1
  • 1
Kevin Lee
  • 1,079
  • 6
  • 17
  • 34
  • Redactor is actually vulnerable to XSS. You should not use its output without further validation. – Gumbo Jun 24 '12 at 06:11
  • This is no different than any other form of user controlled input. A hidden form variable also has a security impact... – rook Jun 24 '12 at 19:45

2 Answers2

0

Accepting any html input from a client is not secure. Even if the jQuery plugin doesn't allow the user to craft XSS, it's very easy to modify the code a client is running.

You should either accept input from the user in something like markdown (for example as StackOverflow does) or with a carefully whitelisted set of HTML tags and attributes (making sure to produce valid HTML as output). That's a very tough thing to get correct though, and it would be best to use a well proven library that does this for best security.

cobbal
  • 69,903
  • 20
  • 143
  • 156
0

The link you are refering to is about sql injection. The point here is that you cannot use client side libraries to prevent against harmful input. However, you use a library to let the user type in formatted text, which is perfectly ok.

What you need to do, regardless of what kind of libraries you use on the client side, is to validate the input you get on the server side. You must acknowledge that a malicious user is technically able to bypass all libraries you have on the client side and send whatever he likes to your server, so the server must validate all input against i.e. sql injection attacks etc.

sstendal
  • 3,148
  • 17
  • 22