Understanding HTML Editor Security Validation

Overview

The HTML Code Editor within Forms, Surveys, and Quizzes now includes enhanced security validation. This feature automatically checks your custom HTML code for potentially unsafe JavaScript patterns that could compromise account security. When unsafe code is detected, the system prevents it from being saved, helping to protect against threats like cross-site scripting (XSS), cookie theft, token or session hijacking, and account takeover attempts.

How Security Validation Works

When you add or edit custom HTML in a Form, Survey, or Quiz builder, the editor scans your code in real-time. The process is simple:

1. Open the builder for your Form, Survey, or Quiz.
2. Add an HTML element or edit an existing one.
3. Click the Edit HTML button.
4. Enter or modify your HTML code.

As you type, the editor analyzes the content. If a security risk is identified:

• A red error message appears below the code editor.
• The Save button becomes disabled and cannot be clicked.
• You must remove or modify the unsafe code before you can save your changes.

What Code Patterns Are Blocked

The validation targets specific JavaScript operations that pose high security risks by potentially exposing sensitive information.

1. Accessing Cookies

Any attempt to read browser cookies is blocked. This includes code like document.cookie or variations such as document['cookie'] and window['document']['cookie']. Cookies often contain authentication tokens, and accessing them could lead to account compromise.

2. Using the eval() Function

The eval() function, which executes a string as code, is blocked (for example, eval("alert('hello')")). This function can be used to hide and run malicious scripts.

3. Using the new Function() Constructor

Creating a new function from a string using new Function() (for example, new Function('return document.cookie')) is blocked because it dynamically executes code and carries risks similar to eval().

4. Using setTimeout() with a String Argument

Calling setTimeout() with a string for the code to execute is blocked (for example, setTimeout("alert('hi')", 1000)). The browser evaluates the string as code. You should instead use a function reference: setTimeout(function() { alert('hi'); }, 1000).

5. Using setInterval() with a String Argument

Similarly, using setInterval() with a string argument (for example, setInterval('checkStatus()', 5000)) is blocked. Use a function reference instead: setInterval(() => checkStatus(), 5000).

6. Reading from localStorage

Code that reads data from localStorage is blocked if it involves retrieving items (for example, localStorage.getItem("authToken")), as this may expose sensitive session or authentication data. Note that writing to localStorage (using setItem), removing items, or clearing storage is allowed.

What Code Is Allowed

The security validation is designed to block only high-risk operations. The following are generally allowed:

• Standard, safe HTML markup.
• JavaScript that does not involve the blocked patterns.
• Arrow functions and standard function definitions.
• Using function references (not strings) with setTimeout and setInterval.
• Writing to localStorage or sessionStorage (writing, removing, clearing).
• Reading from sessionStorage is also permitted.

Important Notes

• The security scan is case-insensitive. It will detect eval, EVAL, Eval, etc.
• If the same security issue appears multiple times in your code, only one error message is displayed.
• Leaving the HTML field completely empty is allowed.
• Pure HTML code without any embedded JavaScript is always allowed.

If Your Code Is Being Blocked

If you receive a security error and cannot save your HTML, review your code and make the following adjustments:

• Remove any statements that directly access document.cookie or browser cookies.
• Avoid using eval() or the new Function() constructor.
• For timers (setTimeout and setInterval), pass a function reference instead of a string of code.
• Do not include code that reads authentication tokens or session data from localStorage.