Using webform regularly, I noticed that for most of the texfields, I don't want any HTML in them (like when I ask for first name, last name...). I know that webform sanitize these fields with check_plain(), but I'd much rather completely forbid any HTML where I can.
Ok, I'm probably a bit paranoid, but try to add some javascript in one of these fields with the webform full debug enabled... or if you follow what is in here (http://drupal.org/node/323666) to send confirmation emails, you could be sending the full content of your un-sanitized texfield in an email.
So, I've been writing a simple rule to check if there's any HTML tags in a textfield (patch attached, but there might be better ways of doing it).
I don't know if you will consider it a worthy addition in your next release ( I know that we could achieve the same rule by using the regexp one), but I thought that if there's something simple already in there, more people are likely to use it and reduce the XSS risk of some of their forms.

CommentFileSizeAuthor
webform_plaintext_rule_20100427a.patch1.04 KBtlaurent

Comments

svendecabooter’s picture

Assigned: tlaurent » svendecabooter

Thanks for your contribution!
The patch seems fine at first sight, although I will have to test it some more.
It seems like a reasonable validation rule to be included in the module.

Assigning this to me to get back to it.

svendecabooter’s picture

Assigned: svendecabooter » Unassigned
Status: Needs review » Fixed

committed to HEAD

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.