AnQiCMS integrates multiple considerations into the security of handling rich text content, from system design to template rendering.
Firstly,AnQiCMS from its corporate-level positioning in Go language has always placed system security at the core.It is dedicated to providing an efficient, customizable and secure content management solution, with a focus on avoiding potential security risks from the outset.The project advantages explicitly mention 'Security Mechanism: including anti-capture interference code, content security management, sensitive word filtering and other functions, ensuring content security and compliance. All these lay a solid foundation for the overall content security of the website.'This means that even though we as users have a high degree of freedom in content creation, the system will also provide a certain level of protection at the bottom layer.
In the input stage of rich text content, AnQiCMS provides a feature-rich editor.Whether it is the conventional WYSIWYG editor or the newly added Markdown editor in the new version, both allow us to organize content in different ways.It is worth mentioning that for the content edited with a Markdown editor, the system provides a mechanism to automatically convert Markdown syntax to HTML.This means that even if we input Markdown format, the structured HTML is presented on the front end in the end.This conversion process itself is controlled by the system, which will ensure the specification of generated HTML to some extent.rel="nofollow"properties.
However,The key to ensuring the safe display of rich text content on the front end lies in the template rendering mechanism of AnQiCMS.To prevent common Web security vulnerabilities such as Cross-Site Scripting (XSS), AnQiCMS's template engine (similar to Django template engine) defaults to automatically escape all HTML content output from the backend editor to the frontend.<script>alert('XSS');</script>It will not be treated as executable JavaScript code by the browser, but will be escaped into<script>alert('XSS');</script>This plain text string has lost its aggressiveness. This automatic escaping is the first and most basic security barrier provided by the system for us.
What should we do when we indeed need to output the original HTML content, such as the main text of an article, complex layout structures?This is where we explicitly tell the template engine that this part of the content is 'safe' and does not require escaping.|safeto implement a filter, for example{{ archiveContent|safe }}The document explicitly mentions this filter and explains its function. In addition,{% autoescape off %}and{% autoescape on %}tags can also control the automatic escaping behavior of certain content in the template.
However,|safeFilter or disable the automatic escaping feature means that we transfer the responsibility of content security review from the system default mechanism to ourselves.The system will now completely trust this content and will no longer perform default escaping.safeIt may open the door for the injection of malicious scripts, leading to attacks on the website. Therefore, in practice, we must follow a set of strict guidelines:
- 优先利用系统默认的自动转义功能 (English)：For most text content that does not require complex HTML structures, keeping the system's default automatic escaping is**a choice, which saves us the trouble of manually reviewing the content and provides basic security.
- Use with caution
|safeFilterOnly when we are sure that the content source is reliable, has been strictly reviewed, and it is indeed necessary to use the original HTML structure (such as article content, content published by system administrators, or fixed content with specific styles or layouts) should it be used.|safe. - Keep alert for user-generated content: For comments, messages, personal profiles, and other content submitted by users that may contain malicious code,must notDirectly use:
|safePerform output.This content should always be automatically escaped by the template engine, or undergo more stringent HTML sanitization on the backend to ensure only safe HTML tags are allowed through. - Regularly check the "Content Settings"Ensure that the security settings such as 'Automatically filter external links' meet the latest security policies and operational requirements of the website.
AnQiCMS through built-in security design, intelligent template automatic escaping processing, and flexible configurable content filtering options, provides multiple guarantees for the safe display of rich text content on the front end.As a website operator, understanding and reasonably utilizing these features is the key to ensuring the stable and secure operation of the website.
Common Questions (FAQ)
Q1: Why does the HTML code I input in the AnQiCMS backend editor become plain text or garbled when displayed on the front end?
A1: This is usually because the AnQiCMS template engine has the default feature of automatic HTML escaping enabled. To prevent cross-site scripting (XSS) attacks, the system will escape HTML tags (such as<script>/<img>Why