Skip to main content
D
DCwebGuy
Inspiring
March 30, 2012
Answered

How do I get around global script protection in my CMS?

  • March 30, 2012
  • 1 reply
  • 1032 views

We have global script protection enabled on our CF server.  I am the admin with full rights.  The tags it scans for and replaces with "invalidTag" are these, which are located in the neo-security.xml file:

     object|iframe|embed|xss|script|javascript|applet|meta

However, we ocassionally introduce these tags into pages controlled by our CMS, which of course go into a database.  When that happens the tags are replaced with "invalidTag".

I want and need script protection enabled to prevent against hackers, but I also want to be able to add these tags to our local CMS.  What is the best way around this?  Right now, I actually had to remove "object" and "embed" from the list it scans against, but I feel like this defeats the purpose.

When I Googled this issue I saw a couple of hacks that had something to do with re-writing the tag after it was sent into the database, but that seems kind of polish to me.  I'm wondering if I'm missing some simple trick to get around this.  But then I guess if I could, a hacker could.

Thanks for any advice.

This topic has been closed for replies.
Correct answer BKBK

Thanks for clearing that up. I think you said it succinctly yourself: 'I actually had to remove "object" and "embed" from the list it scans against, but I feel like this defeats the purpose'. I think it's a matter of weighing the risks and the benefits, and then making a choice.

1 reply

BKBK
BKBK
Community Expert
March 30, 2012

You may of course use those tags in your CMS! Script protection only means you shouldn't pass the tags as part of a CGI, COOKIE, FORM or URL variable.

D
DCwebGuyAuthor
Inspiring
March 30, 2012

My CMS is submitting through forms, so that's why the tags are being caught.  I'm taking about using those tags inside the content that's being submitted by the CMS.  I'm not taking about the code that actually runs the CMS.

BKBK
BKBKCorrect answer
Community Expert
March 30, 2012

Thanks for clearing that up. I think you said it succinctly yourself: 'I actually had to remove "object" and "embed" from the list it scans against, but I feel like this defeats the purpose'. I think it's a matter of weighing the risks and the benefits, and then making a choice.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices