Re: Html_Safe: excluded id/name attributes

On 4/2/06, Sven Fuchs <svenfuchs@artweb-design.de> wrote: > > Html_Safe strips name and id attributes from HTML by default. > > I'd like to know the reason for this. What kind of security problem is > introduced by allowing id/name attributes in arbitrary HTML > (i.e. content submitted by untrusted users)? > > I need to understand possible issues because I've been asked by a > customer to turn this particular setting/behaviour off in his > application - so being able to tell him about the consequences would be > nice. This could allow the users to hijack items that are supposed to be unique within the DOM tree. Um... let's see. User could submit something with an id which is the same as a selector in your CSS which could mess up the site visually. --- also would break validation. This also could cause problems if you use javascript and getElementById('foo') and there are two id='foo' on the same page. The name attribute could cause problems within forms if names collide, or named anchors for bookmarks http://example.com/#foo Those are a couple examples. If you don't use id's in css selectors, javascript with getElementById(), named anchors, or the html won't be displayed within a <form></form> then you shouldn't have too much to worry about - as long as id's don't collide and/or you don't care about w3 validation. I'm sure there are other potential problems, those are a couple I could think of. It think stripping the name and id is a good idea. Thanks in advance :) > > -- > Sven > > -- > PEAR General Mailing List (http://pear.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > -- -Brett http:saltybeagle.com aim:ianswerq