Req #15972 [Opn->Ana]: strip_tags should allow restricting the attributes on tags that are kept
Edit report at https://bugs.php.net/bug.php?id=15972&edit=1
ID: 15972
Updated by: kalle@php.net
Reported by: rn214 at cam dot ac dot uk
Summary: strip_tags should allow restricting the attributes
on tags that are kept
-Status: Open
+Status: Analyzed
Type: Feature/Change Request
Package: Strings related
Operating System: *
PHP Version: *
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2002-05-02 16:10:58] jimw@php.net
rewrote the summary. it would be nice if the syntax were something like: strip_tags($text,
"a[href,target],br,p")
------------------------------------------------------------------------
[2002-03-09 12:08:43] rn214 at cam dot ac dot uk
Oops - that should be
...javascript:document...
------------------------------------------------------------------------
[2002-03-09 11:56:50] rn214 at cam dot ac dot uk
The html strip_tags() function permits any attributes. This gives a security hole. Eg allowing
<b> also permits:
<b onclick="javascript.document.location='http://www.evil.com';">
That's not so nice !
Context: I run a website in which I want to allow (untrusted) users to post messages formatted with
a very limited subset of html. I don't want them to be able to do anything nasty.
I am aware that this may not really be a bug per se, and might be better as a new string function
('vanilla_tags'). But it could bite the unwary.
Thanks a lot
Richard
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=15972&edit=1
Thread (5 messages)