Markdown(带有strip_tags)是否足以阻止XSS攻击? [英] Is Markdown (with strip_tags) sufficient to stop XSS attacks?

问题描述

我正在开发一个Web应用程序，该应用程序允许用户键入目录中项目的简短描述.我允许在我的文本区域中使用Markdown，以便用户可以进行一些HTML格式化.

I'm working on a web application that allows users to type short descriptions of items in a catalog. I'm allowing Markdown in my textareas so users can do some HTML formatting.

我的文本清理功能将任何输入的文本中的所有标签删除，然后再将其插入数据库中:

My text sanitization function strips all tags from any inputted text before inserting it in the database:

public function sanitizeText($string, $allowedTags = "") {
    $string = strip_tags($string, $allowedTags);

    if(get_magic_quotes_gpc()) {
        return mysql_real_escape_string(stripslashes($string));
    } else {
        return mysql_real_escape_string($string);
    }
}

本质上，我存储在数据库中的所有内容都是Markdown －不允许使用其他HTML，甚至不允许使用基本HTML"(例如SO).

Essentially, all I'm storing in the database is Markdown--no other HTML, even "basic HTML" (like here at SO) is allowed.

允许降价会带来任何安全威胁吗?即使没有标签，markdown仍可以XSSed吗?

Will allowing markdown present any security threats? Can markdown be XSSed, even though it has no tags?

推荐答案

我认为，从输入中剥离任何HTML标记将为您提供一些安全的方法-除非有人找到一种将一些真正混乱的数据注入Markdown的方法，让它产生更多混乱的输出^^

I think stripping any HTML tag from the input will get you something pretty secure -- except if someone find a way to inject some really messed up data into Markdown, having it generate some even more messed-up output ^^

仍然，这是我想到的两件事:

Still, here are two things that come to my mind :

第一个: strip_tags不是奇迹功能:它有一些缺陷...
例如，在这种情况下，它将删除'<'之后的所有内容:

First one : strip_tags is not a miracle function : it has some flaws...
For instance, it'll strip everything after the '<', in a situation like this one :

$str = "10 appels is <than 12 apples";
var_dump(strip_tags($str));

我得到的输出是:

string '10 appels is ' (length=13)

这对您的用户不太好:-(

第二个::或者某天，您可能需要允许一些HTML标记/属性；或者甚至在今天，您可能要确保Markdown不会生成某些HTML标记/属性.

Second one : One day or another, you might want to allow some HTML tags/attributes ; or, even today, you might want to be sure that Markdown doesn't generate some HTML Tags/attributes.

您可能会对 HTMLPurifier 之类的东西感兴趣:它允许您指定应保留哪些标记和属性，以及过滤字符串，以便仅保留这些字符串.

You might be interested by something like HTMLPurifier : it allows you to specify which tags and attributes should be kept, and filters a string, so that only those remain.

它还会生成有效的HTML代码-总是很好;-)

It also generates valid HTML code -- which is always nice ;-)

这篇关于Markdown(带有strip_tags)是否足以阻止XSS攻击?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！