# Hugo + CMS and 'unsafe = true'

**URL:** <https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069>\
**Category:** support\
**Tags:** netlify\
**Created:** [October 9, 2021, 1:12am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069 "2021-10-09T01:12:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![iaeiou](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/iaeiou/32/15332_2.png) [@iaeiou](https://discourse.gohugo.io/u/iaeiou)\
**Post date:** [October 9, 2021, 1:12am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/1 "2021-10-09T01:12:04Z")

</div>

Hi there,

we are reviewing Hugo Themes, in particular Netlify-CMS compatible themes.

We would like with this CMS to open the publication:

- to users with no technical skills ( i.e pasting random content in the CMS)
- to users we don’t trust ( i.e potentially trying to exploit the platform)

No moderation will take place, the content goes straight from the CMS to some live & public HTML.

**Question #1: Do you have general advice about this usecase?**  
(let’s first consider that `unsafe` is set to `false`)

## The case of unsafe = true

Some appealing themes are shipping Netlify-CMS / Forestry and use the following setting in `config.toml`:

```auto
[markup.goldmark.renderer]
  unsafe = true  

```

The [documentation is short on this topic](https://gohugo.io/getting-started/configuration-markup#goldmark) (see also [#6581](https://github.com/gohugoio/hugo/issues/6581)).

**Question #2: How to scope the risks induced by this setup? Is the content absolutely unfiltered in such a situation?**

**Question #3: Do you think of a way to properly filter the content submitted via a CMS?**

Thanks!

---

<div class="post-metadata">

**Author:** ![jmooring](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/jmooring/32/4214_2.png) [@jmooring](https://discourse.gohugo.io/u/jmooring)\
**Post date:** [October 9, 2021, 4:12am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/2 "2021-10-09T04:12:10Z")

</div>

> [@iaeiou](#):
>
> Do you have general advice about this usecase?

Yes. Don’t do it.

> [@iaeiou](#):
>
> Is the content absolutely unfiltered in such a situation?

Yes. A user could include this with their markdown:

```HTML
<script>
  alert("Ha ha ha");
</script>

<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Libre+Barcode+39&display=swap" rel="stylesheet">

<style>
  body {
    font-family: 'Libre Barcode 39', cursive;
    font-size: 400%;
    color: red;
  }
</style>

```

After pressing OK in the “Ha ha ha” alert popup, any text on the page will be rendered as a giant red barcode.

Or they could just burn CPU cycles and freeze the browser tab with:

```auto
<script>
  var i = 0;
  while (1) {
    console.log(i)
    i++
  }
</script>

```

> [@iaeiou](#):
>
> Do you think of a way to properly filter the content submitted via a CMS?

Moderate the content (or limit to trusted users) and use the default security model (unsafe = false).

---

<div class="post-metadata">

**Author:** ![iaeiou](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/iaeiou/32/15332_2.png) [@iaeiou](https://discourse.gohugo.io/u/iaeiou)\
**Post date:** [October 9, 2021, 5:13am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/3 "2021-10-09T05:13:00Z")

</div>

It couldn’t be any clearer, thank you @jmooring !

The solution is to implement selected usage with shortcodes I guess.

---

<div class="post-metadata">

**Author:** ![pamubay](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/pamubay/32/17838_2.png) [@pamubay](https://discourse.gohugo.io/u/pamubay)\
**Post date:** [October 9, 2021, 5:51am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/4 "2021-10-09T05:51:10Z")

</div>

Also note, even you set `unsafe=false`,

since Markdown Attributes feature released, event handler can be attached to code fence via `on<event>` in markdown attributes, and there is no config to disable this.

````auto
# do not directly copy below code, it contains zero-width space before the triple backticks (to avoid discourse render it)

​```html {onclick="alert('xss')" onmouseenter="alert('xss-onmouseenter')"}
<h1>Hello World</h1>
​```

````

@jmooring @iaeiou

---

<div class="post-metadata">

**Author:** ![iaeiou](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/iaeiou/32/15332_2.png) [@iaeiou](https://discourse.gohugo.io/u/iaeiou)\
**Post date:** [October 9, 2021, 6:08am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/5 "2021-10-09T06:08:05Z")

</div>

> Also note, even you set `unsafe=false` ,
> 
> since Markdown Attributes feature released, event handler can be attached to code fence via `on<event>` in markdown attributes, and there is no config to disable this.

Confirmed, tested with `unsafe = false` and an alert is displayed.

---

<div class="post-metadata">

**Author:** ![system](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.gohugo.io/system/32/1_2.png) [@system](https://discourse.gohugo.io/u/system)\
**Post date:** [October 11, 2021, 6:08am UTC](https://discourse.gohugo.io/t/hugo-cms-and-unsafe-true/35069/6 "2021-10-11T06:08:47Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.