1

I am currently implementing WYSIWYG editor that will be available on the web, what are the main security issues I should tackle? The editor currently works that when user is done typing, the text gets saved to folder with editor text on same domain, and the iframe gets refreshed with the contents of it.

I know that when it comes to JS, someone could scale up the DOM from the parent windows, but how could that affect security of my website?

The editor instances are not share-able between users and never will be. Only admins can view all instances.

Improve this question

1 Answer 1

Reset to default
1

User input (especially deliberate provision of) is almost always a vector for possible vulnerabilities.

That being said, a full-pledged WYSIWYG editor implemented in HTML/CSS/Javascript can introduce cross-site scripting (XSS) vulnerabilities, aside from "cute" pranks like visible div blocks that cover your site's pages, to annoying JS-based alerts to malicious ones that trigger a rogue web service et.al. unless you filter the tags and escape properly the generated HTML.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.