HTML Purifier is very tasty when combined with WYSIWYG editors and is more comprehensive and secure than Drupal's built-in filtered HTML option.

How is it more secure than Drupal's built-in filtered HTML option?

If you know of a weakness, please mail security@drupal.org

Comments

ezyang’s picture

ezyang commented

"More secure" is a bit sensational. The word isn't used in the sense that Drupal has specific vulnerabilities, but rather that HTML Purifier's approach has been shown overall to be more secure and future-proof. Drupal is based off of kses, software I've never liked very much (it doesn't tag balance, check most attributes except that which is absolutely essential, and is used by Wordpress, which says something).

Perhaps here isn't a good place to discuss this. Where should I bring up my concerns with Drupal's filtered HTML implementation? In the meantime, I'll reword to be a little less contentious.

ezyang’s picture

ezyang commented
Status: Active » Fixed

Summary has been reworded to be more neutral. Thank you for the report!

ezyang’s picture

ezyang commented
Status: Fixed » Closed (fixed)

Marking closed, evidently "fixed" isn't the proper term for it.