Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Feb 28, 2011 0:28:19 GMT -8
Post by Bones on Feb 28, 2011 0:28:19 GMT -8
The pitfalls of HTML are just too dangerous and recent indications suggest such a code would be declared banned from Proboards!
Browsers Tested: firefox
Placement: Global Footer
Description: This is a very preliminary draft of a doHTML script for Proboards. The dangers in allowing every user the ability to post raw HTML is well known and this is exactly the reason why UBBC was created. The problem with UBBC however is in it's efforts to disallow malicious users posting something that could conceivably affect or even infect everyone else it has gone a bit overboard by totally removing the cooler aspects of HTML. This code attempts to bring back the ability to use some of those cooler aspects while still being wary of malicious users.
Script tags for example are totally ignored so don't even try posting them. Element events are also disabled (e.g. onmouseover="blah") since that is also another avenue of attack. Elements that load external sources (such as image and embed tags) can also offer another avenue of attack (malformed URI that evaluate to script) but removing the ability to use images would not be desirable so that aspect alone makes this script still a bit dangerous. Modern browser can detect these exploits and warn the user (or simply ignore) but older browsers (IE6 users beware) are still susceptible to such exploits.
Usage: post the HTML in a UBBC
|
|
|
DoHTML
Feb 28, 2011 1:31:13 GMT -8
Post by Wormopolis on Feb 28, 2011 1:31:13 GMT -8
I will create a board in the testing area that will demo this
|
|
|
DoHTML
Feb 28, 2011 23:53:43 GMT -8
Post by Wormopolis on Feb 28, 2011 23:53:43 GMT -8
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 1, 2011 15:16:34 GMT -8
Post by Bones on Mar 1, 2011 15:16:34 GMT -8
That is due to an errant font tag in the HTML <tr><td class="titlesmall" colspan="3" style="text-align:center; font-family: Tahoma; font-size: 9px; background-color: #709170"> STATISTICS</td></tr>
<tr style="background-color:#f0f0f0; text-align:center; font-family: Tahoma; font-size: 9px"> <td style="text-align:center; background-color:#f0f0f0; font-family: Tahoma; font-size: 9px; line-height: 12px"><div align="justify" style="padding-top:5px; padding-left:5px; padding-right:5px; padding-bottom:5px;"><center>Males: 8 Females: 12 </center></font></div></td> </tr>
There's a closing font tag but no corresponding opening font tag. Trying to get the code to "fixup" bad markup like that would grow it way too large for it to be of any use.
|
|
|
DoHTML
Mar 1, 2011 17:40:01 GMT -8
Post by Wormopolis on Mar 1, 2011 17:40:01 GMT -8
you have mod control over that thread btw. in case you want to experiment.
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 12, 2011 13:41:08 GMT -8
Post by Bones on Mar 12, 2011 13:41:08 GMT -8
code updated to v0.3.00 (promoted from ALPHA to BETA)
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 13, 2011 16:46:28 GMT -8
Post by Bones on Mar 13, 2011 16:46:28 GMT -8
code updated to v0.3.04 with addition of "inline" parameter, UBBC button and disallowedTags variable to selectively ignore specific HTML tags (script tags still disallowed regardless).
|
|
Rei Kon
Junior Member
Posts: 52
Rei Kon said 0 great things
|
DoHTML
Mar 18, 2011 14:11:47 GMT -8
Post by Rei Kon on Mar 18, 2011 14:11:47 GMT -8
Hey - I'm using 3.00 as I couldn't get 3.04 to work using quote or code tags in firefox or chrome - just wondering if there's any way this code could be adjusted so only specific trusted usernames could include script elements? Hope this isn't jumping the gun too much
|
|
|
DoHTML
Mar 18, 2011 14:27:15 GMT -8
Post by Wormopolis on Mar 18, 2011 14:27:15 GMT -8
It wont ever be changed to allow script elements as far as I know. Too much risk involved. Eton has to make that call.
|
|
Rei Kon
Junior Member
Posts: 52
Rei Kon said 0 great things
|
DoHTML
Mar 18, 2011 14:32:05 GMT -8
Post by Rei Kon on Mar 18, 2011 14:32:05 GMT -8
It would only be for one person - that would be main admin (aka me) that would be listed as a username - I understand the risk, its for a system I'm trying to build with using posts to list 'shop' items
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 18, 2011 14:37:35 GMT -8
Post by Bones on Mar 18, 2011 14:37:35 GMT -8
You can use SubDevo's HTML in Post code if you want to allow specific users to post scripts within posts, this code is attempting to give everyone the ability to use HTML but with safeguards in place.
|
|
Rei Kon
Junior Member
Posts: 52
Rei Kon said 0 great things
|
DoHTML
Mar 18, 2011 14:38:42 GMT -8
Post by Rei Kon on Mar 18, 2011 14:38:42 GMT -8
Would this work alongside doHTML?
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 23, 2011 13:08:04 GMT -8
Post by Bones on Mar 23, 2011 13:08:04 GMT -8
Would this work alongside doHTML? As long as it runs AFTER the doHTML code it should be fine. Could you link to a thread where you say v0.3.04 is not working in Firefox or Chrome since I see no difference in Chrome, Firefox, Internet Explorer or Opera when testing this code
|
|
Rei Kon
Junior Member
Posts: 52
Rei Kon said 0 great things
|
DoHTML
Mar 25, 2011 10:28:51 GMT -8
Post by Rei Kon on Mar 25, 2011 10:28:51 GMT -8
|
|
Bones
Code Helper
Posts: 131
Bones said 0 great things
|
DoHTML
Mar 25, 2011 18:07:13 GMT -8
Post by Bones on Mar 25, 2011 18:07:13 GMT -8
Well since that thread is using CODE instead of QUOTE tags it would not be compatible with the newer version. The reason that change was made was the result of viewing a few doHTML data examples and seeing that they in fact mixed UBBC with HTML and expected the UBBC to be rendered as normal and the HTML to be handled by the code. As you know, most UBBC don't render in code tags so that approach would not be compatible with existing dohtml data being imported from "somewhere else".
|
|