I am currently implementing WYSIWYG editor that will be available on the web, what are the main security issues I should tackle? The editor currently works that when user is done typing, the text gets saved to folder with editor text on same domain, and the iframe gets refreshed with the contents of it.
I know that when it comes to JS, someone could scale up the DOM from the parent windows, but how could that affect security of my website?
The editor instances are not share-able between users and never will be. Only admins can view all instances.
1 Answer 1
User input (especially deliberate provision of) is almost always a vector for possible vulnerabilities.
That being said, a full-pledged WYSIWYG editor implemented in HTML/CSS/Javascript can introduce cross-site scripting (XSS) vulnerabilities, aside from "cute" pranks like visible div blocks that cover your site's pages, to annoying JS-based alerts to malicious ones that trigger a rogue web service et.al. unless you filter the tags and escape properly the generated HTML.