Saving from source dialog executes script tag contents

[toshniba]

Type of report

Bug

Provide detailed reproduction steps

1. Click on source button
2. enter <script>alert('poc');</script>
3. Click on save button

Expected result

Script tag should be removed before saving as it would when changing back from source view before saving.

Actual result

Seems the sanitizer is not executed when saving from source view.

Other details

• CKEditor version: 4.12.1

[f1ames]

@toshniba I assume Save button you mentioned is some custom integration because CKEditor 4 doesn't provide one.

The getData() method called when editor is in Source Mode returns it's current content. Since you are able to type anything there (that's its purpose) and it is parsed and converted when switching to WYSIWYG mode, you will get raw data. It works like that by design. Your implementation should only allow saving data when in WYSIWYG mode.

[toshniba]

This is definitely an official plugin as stated out on its site:
https://ckeditor.com/cke4/addon/save
Please reopen and classify as a bug then.

[f1ames]

@toshniba Thank you for clarification, we will re-investigate this issue.

[Dumluregn]

This behaviour can be reproduced using our sample for save plugin.
It still needs to be clarified though if we should filter content in this case or leave it to developers to take care the content they send to server is properly validated.

[spacevoyager78]

As a temporary workaround, I would cancel the 'save' event and alert the user when in source mode, by checking mode property in 'save' event.
Something like that:

CKEDITOR.instances.editor1.on('save', function(evt) {
	if (evt.editor.mode == 'source') {
		alert('You can't save contents in source mode');
		evt.cancel();
	} else {
		// continue with save
	}
});

[spacevoyager78]

Or even better, disable toolbar icon for source mode:

CKEDITOR.instances.editor1.on('instanceReady', function(evt) {
	evt.editor.commands.save.modes.source = 0;
}

[Dumluregn]

Although it's not really bug on our side, we think it wouldn't harm to filter editor content in the case you described, so we will treat it as a feature request.