posts - 81, comments - 197, trackbacks - 0

Easily Injecting HTML into RadEditor


This is a demonstration on how easily client side content can be injected at runtime. One does not have to architect posts or recreate content and repost. The easiest way to do this that I know of is with a firefox plugin called Chickenfoot, http://groups.csail.mit.edu/uid/chickenfoot/install.html. With it you can script navigation, user interaction, changes to DOM, etc.

On to the demo at hand. For this I have taken an instance of RadEditor, a WYSIWYG html editor and disabled almost everything. So if the client side restrictions were 'strong' the user wouldn't be able to do anything but insert plain text into the region on the page. The screenshot below shows the initial setup.

For a real quick demonstration, enter 'placeholder', or any placeholder into the region. Now write the script with chickenfoot to replace it with your html. Such as :

Running this results in the following:

Now granted, this is nothing impressive; we have modified the content within our browser, who cares? Well, that depends on the who programmed the site. If they are assuming the control is taking care of injection they might be in for a surprise. The lesson? Always validate server side for any input imaginable, anything can be posted… and it just got easier to pull off.

And in case it hasn't come to mind, you could very easily inject a full screen div to hijack the page the html is shown on. I doubt someone would go through the trouble for some bolding tags.

 

 


Print | posted on Saturday, May 17, 2008 8:13 PM | Filed Under [ Web Programming ]

Feedback

Gravatar

# MBA essay editing

Top Admit offers MBA essay editing, admission essay, personal statement sample, personal statement sample and more essay editing services. We are among best essay editor, also know how to write a personal statement.
8/28/2012 5:13 AM | MBA essay editing
Gravatar

# re: Easily Injecting HTML into RadEditor

I really appreciate the type of topics you post here. Thanks for sharing data that's really useful. Good day!
11/6/2012 1:26 AM | Spanish to English translation
Gravatar

# re: Easily Injecting HTML into RadEditor

Wow nice info you've got here.Thanks for sharing this fascinating diary. truly google created looking of data simple on any topic. Well keep it up and post additional fascinating blogs.
11/16/2012 6:37 AM | Property Barcelona
Gravatar

# Teaching in china

I’ve been browsing online from more time, yet I never
found any interesting article like yours. It is pretty worth enough for me.

In my view, if all webmasters and bloggers made good content blog and article as you did,
the internet will be much more useful than ever before.
11/14/2013 7:36 AM | Teaching in china

Post Comment

Title  
Name  
Email
Url
Comment   
Please add 7 and 7 and type the answer here:

Powered by:
Powered By Subtext Powered By ASP.NET