We have seen these false reports for years. Just because a file within a directory called tinymce has a security issue doesn't mean that it's part of the product. It's like saying that Linux has a security issue since an PHP page has SQL injections and it's hosted on a Linux machine. Sometimes you need to set the record straight.

Afraithe,

I am a religious user of TinyMCE - awesome product!

When allowing a user to submit HTML that might be viewed by other users, you are facilitating possible XSS! It's crucial to have a policy engine on the server that validates that users are submitting "SAFE HTML that adheres to a strict policy specific to your application - and that user driven HTML does not contain malicious javascript.

For this purpose, I use OWASP AntiSamy - http://www.owasp.org/index.php/Category … my_Project another open source project

The OWASP AntiSamy project is a few things. Technically, it is an API for ensuring user-supplied HTML/CSS is in compliance within an application's rules. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc. that gets persisted on the server. The term malicious code in terms of web applications is usually regarded only as JavaScript. Cascading Stylesheets are only considered malicious when they invoke the JavaScript engine. However, there are many situations where "normal" HTML and CSS can be used in a malicious manner.

So WHENEVER you allow a user to submit HTML to your site with TinyMCE, make sure you validate that HTML!!! Strictly! Like Afraithe is saying, anything can be manipulated on the client - so validate on the server - and validating HTML is not easy. So consider a project like OWASP AntiSamy on the server when you use TinyMCE on the client.

We have written a XSS HTML validator that we might release as a TinyMCE package it takes care of all the common XSS patterns. But I must say it is a bit tricky since you can have JS in style attributes, events, urls and all these can be entity encoded or url encoded or even padded with null bytes.