RadEditor and Cloudflare Web Application Firewall

[Daniel]

We use the Cloudflare service for a site that uses RadEditor controls on several pages. When the Cloudflare web application firewall is turned on, a POST with HTML in a RadEditor control triggers several XSS and SQL Injection rules in the web application firewall. There were so many false positives that the web application firewall was immediately turned off.

Does anyone have experience resolving this issue by either changing the settings/configuration of the RadEditor controls, or by tweaking the Cloudflare Web Application Firewall rules?

Please note that I'm not suggesting that this is a flaw in the RadEditor control. The RadEditor provides an amazing amount of functionality.

Thanks

[Marin Bratanov]

Hi Daniel,

I'm guessing that the firewall inspects the contents of the POST and it finds that there is HTML in it (even though RadEditor sends it encoded). Since this is the standard way to send data to the server (being part of the POST), RadEditor would not have a configuration that can change this - ultimately, the data from the user input in it must be available as part of the POST data for the control to work.

What I can suggest you look into is the following:

• see whether some transformation of the content can help you get it past the firewall. You can create your own content filter that will transform the content accordingly, then apply the reverse transformation on the server before using it.
• see if you can use the OnClientSubmit event of the editor to fetch the content from it and send it in some form to the server (e.g., send to some sort of service)
• if the editor is not too prevalent in your app, perhaps you can keep it on a concrete form that you can use in an <iframe> or RadWindow and save it only through it, and allow such special content with code in it for that particular path, if that's a feature offered by the firewall

I hope someone who has experience with the CloudFlare software will also happen upon this thread and be able to offer some ideas from that perspective as well.

Regards,
Marin Bratanov
Progress Telerik

[Daniel]

Thanks for your response. I'll give those suggestions a try.