Sikkerhed

A rich text editor takes HTML from a browser, and a browser is not trustworthy. RayCraft Write treats everything that arrives from the browser as untrusted and filters it on the server before your code sees it.

What ContentFilter does

• Only elements from an allow list are kept (the default list covers text, lists, tables, images, links, figures, details, audio, video and sandboxed frames). script, style, object, embed, forms and everything else are removed.
• Event attributes (onclick and the like) are always removed.
• Attributes are allowed per element: for example href, target, rel on links; src, alt, width, height, loading on images; colspan, rowspan, scope on cells.
• Addresses are checked: javascript: and similar schemes are removed. Links keep http, https, mailto and tel and relative addresses.
• Frames are kept only for the hosts in Embed.AllowedHosts (by default www.youtube-nocookie.com and player.vimeo.com) and always with a sandbox.
• style attributes are reduced to a list of safe properties.

Change the lists through AddRte(o => o.Filter = new ContentFilterOptions { ... }). The defaults are in ContentFilterOptions.DefaultAllowedTags, DefaultAllowedAttributes and DefaultAllowedAttributesByTag.

Where it is applied

• The bound Value that the editor sends to your page (FilterIncomingHtml, on by default).
• HTML that you set with SetHtmlAsync or InsertHtmlAsync, and the HTML that is first drawn on the server.
• Pasted content (it is also cleaned from Word and Excel markup in the browser, but the browser is not trusted: the server filter has the last word).

When you use Rte.Processing without the editor (for example in an API that receives HTML), call ContentFilter.Filter yourself.

Conversions

Markdown and JSON conversions do not pass raw HTML through. E-mail and static outputs are made from the filtered HTML.

Files and uploads

• FileSystemMediaStore checks the extension against Upload.AllowedTypes and AllowedImageTypes, checks the first bytes of an image, limits the size (Upload.MaxFileSize) and never uses a path from the browser as it is.
• The upload runs over the SignalR connection of the page, so it needs the same authorization as the page. A custom IRteMediaStore should authorize every call itself: the editor does not know who your users are.
• Serve uploaded files from a folder that cannot run scripts, and prefer a different host name for user content.

What stays your responsibility

• Output encoding: show stored HTML only after filtering, and show it with StaticRender.Render or in a page that does not run user scripts.
• Authorization of who can edit which document (DocumentId is a name, not a permission).
• Revisions and comments in your own stores: apply your own access rules.
• A Content Security Policy for your site. The editor loads its scripts and styles from _content/Rte/, and the demo of equations or diagrams may load KaTeX or Mermaid from the place you choose.
• Protection of the feed token (Installation).

Reporting a problem

If you find a way to get a script through the filter or to read a file outside the media folder, please report it to RayCraft before you publish it. Contact details are in the license file (License).