Bring back HTML code

[Kosmonaut]

It seems that HTML is not allowed anymore in posts. I had not noticed this before, until now, that I wanted to use it. Why was disallowed?

Please bring back the HTML code!

 

[DarkUnderlord]

Nope, OSK is actually right when he says it's a security risk.

 

[mahdi]

Denied because Andhaira got hacked. I never thought I'd say this but, God bless Andhaira!

 

[Kosmonaut]

 

[racofer]

Nope, OSK is actually right when he says it's a security risk.

And here I was thinking the Codex was hardcore and edgy, willing to venture where other faggotry ridden forums wouldn't.


Boy was I mistaken.

 

[denizsi]

Codex posts supported HTML?

 

[racofer]

Yes, until approximately a year ago where OSK hacked the forums to prove a point.

 

[DriacKin]

A few month ago, OSK demonstrated a legit security risk related to javascript and cookies. Instead of actually fixing the problem, DU just decided to ban html.

 

[OSK]

Instead of actually fixing the problem, DU just decided to ban html.

This really isn't a problem you can fix. I'm pretty sure you can execute javascript from every HTML tag. You can try to sanitize the HTML, but that's no small feat. You'd either have to make the HTML extremely restrictive (at which point you may as well just be using BBCode) or attempt to catch every possible scenario where someone may try to sneak in some unwanted code.

Here's a nice big list of some ways you might be able to bypass filtering: http://ha.ckers.org/xss2.html

Completely disallowing HTML is really the only safe way to go. Things most people want to do with HTML can be replicated in BBCode anyway.

 

[Occasionally Fatal]

It's not like all the cool new forums allow html or anything.

 

[DriacKin]

Instead of actually fixing the problem, DU just decided to ban html.

This really isn't a problem you can fix. I'm pretty sure you can execute javascript from every HTML tag. You can try to sanitize the HTML, but that's no small feat. You'd either have to make the HTML extremely restrictive (at which point you may as well just be using BBCode) or attempt to catch every possible scenario where someone may try to sneak in some unwanted code.

Here's a nice big list of some ways you might be able to bypass filtering: http://ha.ckers.org/xss2.html

Completely disallowing HTML is really the only safe way to go. Things most people want to do with HTML can be replicated in BBCode anyway.

I'd be somewhat surprised if there weren't already existing solutions that account for all this crap. Seems like something that'd be pretty useful...

 

[L'ennui]

Instead of actually fixing the problem, DU just decided to ban html.

This really isn't a problem you can fix. I'm pretty sure you can execute javascript from every HTML tag. You can try to sanitize the HTML, but that's no small feat. You'd either have to make the HTML extremely restrictive (at which point you may as well just be using BBCode) or attempt to catch every possible scenario where someone may try to sneak in some unwanted code.

Here's a nice big list of some ways you might be able to bypass filtering: http://ha.ckers.org/xss2.html

Completely disallowing HTML is really the only safe way to go. Things most people want to do with HTML can be replicated in BBCode anyway.

I'd be somewhat surprised if there weren't already existing solutions that account for all this crap. Seems like something that'd be pretty useful...

Feel free to invent one, I guess.

 

[DarkUnderlord]

I'd be somewhat surprised if there weren't already existing solutions that account for all this crap. Seems like something that'd be pretty useful...

There is. It's called BBCode.

No really, that's why BBCode was invented. It's basically a whitelist of acceptable HTML codes.

 

[Kosmonaut]

Is there a way to put attributes to IMG tags? like width and height, alt text, etc.?

That's why I miss HTML code.