XSS vulnerability in Admin Config about gae-init

[lipis]

Yes I'm aware of that and the reason that I didn't want to escape or treat it with care is because, sometimes you want to add links or make something strong or have a header.. and as you mentioned from the admin console you can do a lot of bad things so you better be careful who is admin and who is not :)

[mdxs]

Understand and no problem there. However, I want to use HTML input elsewhere too; and there I will need to sanitize the user input; thinking of adding Bleach (possibly in combo with either CKEditor or TinyMCE).

Unless you tell me that we already have some "cleaner" build into gae-init ?

[lipis]

Well by default Jinja2 is escaping the variables and unless you're explicitly saying that it's safe (at your own risk) it won't escape them..

Just remove the | safe filter there and you'll see...
https://github.com/gae-init/gae-init/blob/master/main/templates/bit/announcement.html#L4

You can read more about it here: http://jinja.pocoo.org/docs/templates/#html-escaping

[mdxs]

Sure, but I want to render the user input HTML ... thus I need to clean it on input.

BTW: I'm okay with this being "my" problem, in that gae-init will not dictate a particular approach to this issue.

[lipis]

If you have the user input and it's actually HTML but you still want to be a bit safe then I guess you'll have to make some research on what exactly suits your needs.. if it's going to be client side or server side... if it's going to clean up some HTML tags or just escape them etc..

But if you're between CKEditor or TineMCE I would suggest you go with the CKEditor, because I played with TinyMCE in the past and it's pain... CK looks more robust and produces a friendlier HTML and cooler features..

[mdxs]

As said in closing #61 "Fixed XSS vulnerability in Admin Config": yes, it is important to avoid/fix XSS vulnerabilities in your final product; the PR #61 hints at one such approach (using https://github.com/jsocol/bleach and https://github.com/html5lib/html5lib-python) and will resolve the issue. However, gae-init does not need to mandate this particular solution.