TinyMCE Text editor security with HTML

Question

I'm using the free JS plugin from tinymce and interested in preventing an HTML injection with the tinymce text editor. I've added this property to the INIT:

invalid_elements: 'script' (just for this example)

However nothing happens. The editor still "accepts" the script tag and pass it on.

I looked at https://www.tiny.cloud/docs/tinymce/6/content-filtering/#invalid_elements and it should work but I don't see any change once it's added.

Am I doing something wrong?

Is there a way to limit some HTML elements with this editor?

Any other tips on how to use that editor and prevent the malicious HTML..?

Answer 1

TinyMCE certainly has a variety of configuration options to help you control what content is created in the editor but you can never assume that data provided to you client side is "clean" or "safe". Nefarious people can bypass your front end and all of its validation if their goal is to cause harm to your system.

You should always configure your front end appropriately. TinyMCE has a variety of configuration options to assist with content filtering/validation ( https://www.tiny.cloud/docs/configure/content-filtering/ ) to only allow those types of tags you want created, etc including:

• https://www.tiny.cloud/docs/configure/content-filtering/#valid_elements
• https://www.tiny.cloud/docs/configure/content-filtering/#extended_valid_elements
• https://www.tiny.cloud/docs/configure/content-filtering/#valid_children
• https://www.tiny.cloud/docs/configure/content-filtering/#schema
• https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements

However, regardless of the front end design, you should always re-check submitted content on the server to ensure it is safe . There is simply no way around that need. What constitutes "safe" is likely a business decision based on what your application does and who uses it.

There are many different libraries you can use server side to do this sort of validation/cleansing so depending on your specific server side setup you can find libraries that allow you to "sanitize/purify" the submitted HTML.

I would note that TinyMCE (by default) should not allow <script> tags in your content so it is likely that such behavior could be due to your current configuration.