Security risk with HTML tag insertion?

Running 0.9.6.2 version here, and I noticed that HTML tags are allowed and not escaped in site_content’s pagetitle property (and other document properties.) This could lead to security issues if someone manages to insert some XSS code in a document’s properties. This also doesn’t comply with W3 standard, especially for the <title> tag.

Of course this only applies with the output is sensitive to these tags (HTML, XML, etc...) Is there any type of escaping for HTML output that can be enforced?

You could check out HTML Purifier, which seems to do exactly what you need (prevents XSS, makes sure your code is standards compliant). There’s a MODx plugin for it too (about halfway down that page) which is pretty easy to install.

If you’re using PHx
http://wiki.modxcms.com/index.php/PHx#notags

You’re talking about values submitted from within the Manager, right? I don’t think there’s any need to sanitize tags from those fields, since you must be logged in to enter data there. Also consider that not everyone uses those fields in the same way that you do (for example, I often use pagetitle for things other than the <title> tag and when I use introtext as a meta description I strip tags from it in my meta tags snippet (so I can have tags in there for ditto pages and search results).

If you’re really worried about this, you can always sanitize the values before outputting them to your pages.

If you’re really worried about this, you can always sanitize the values before outputting them to your pages.

Agreed, if you want to sanitize the values then you could use a plugin (on saving the ’document edit’ form via the manager) or use a snippet in the frontend to do that.