允许用户输入 HTML - 这明智吗？
我的网站允许人们（任何拥有免费帐户的人）输入文本。到目前为止，我一直在删除 HTML 标签等，以确保它们不能输入任何恶意内容。然而现在，客户询问是否可以允许用户输入html。
这背后的想法是，一些用户可能希望添加更复杂的东西，例如表单。他们输入的任何内容稍后都会显示在另一个页面上 - 因此他们可能需要一个其他人可以填写和提交的表单。
我的问题是，这样做有什么风险？显然我会转义字符以降低注入攻击的风险，但我还需要注意什么？
或者这是否太危险以至于我根本不应该这样做？
My site allows people (anyone with a free account) to enter text. Up till now, I've been stripping out HTML tags etc. to ensure that they can't enter anything malicious. Now, however, the client has asked whether it would be possible to allow the users to enter html.
The thinking behind this is that some users may wish to add more complex things, such as forms. Whatever they enter is displayed on another page, later - so they may want a form which other people can complete and submit.
My question is, what are the risks with this? Obviously I would escape characters to cut the risk of injection attacks, but what else do I need to be aware of?
Or is this so risky that I shouldn't do it at all?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
存在许多风险 - XSS 是最知名的。
如果转义字符，则不会显示 HTML（您将看到
link，而不是链接，例如）。允许 HTML 成为一种安全的方式非常困难。
考虑使用类似于 StackOverflow 上使用的 Markdown 编辑器 - wmd-new。
There are many risks - XSS being the best known.
If you escape characters, then HTML will not be displayed (instead of a link you will see
<a href="http://example.com">link</a>, for example).Allowing HTML is a safe manner is very difficult.
Consider using something like the markdown editor used here on StackOverflow - wmd-new.
一点挑剔的地方...
永远不要假设您的安全性是完整的:)现在，我们来看看实际的答案...
您最大的安全问题是跨站脚本。
这一点是我觉得特别令人不安的：
提交到什么？他们是否也在以某种方式设计服务器端功能？或者他们正在编写表格以提交给某些外部资源？这听起来很冒险。
然后你会进入诸如
script标签之类的东西。在这里可以做非常恶意的事情。如果用户足够精明，能够制作自己的 HTML 表单（手动？或者正在使用工具？）以将数据提交到其他资源，那么他们可能足够狡猾，可以编写一些 JavaScript。使用为此设计的编辑器可以实现简单的标记效果。但形式是一种全新的游戏。这听起来确实很危险。
One nit-picky bit...
Never assume your security is complete :) Now, on to an actual answer...
Your biggest security concern here would be Cross-site Scripting.
This bit is what I find particularly troubling:
Submit to what? Are they also designing server-side functionality somehow? Or are they writing forms to submit to some external resource? That sounds risky.
Then you get into things like
scripttags. Very malicious things can be done here. And if the users are savvy enough to craft their own HTML forms (by hand? or is a tool being used?) to submit data to other resources, they're probably crafty enough to write some JavaScript.Simple markup effects can be achieved with editors designed for that. But forms are a whole new ballgame. This sounds really risky.