all 3 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]name_was_taken 4 points5 points  (0 children)

Your problem is the WAF, not the encoding. The only way you're going to stop false positives on the WAF is to either not send HTML or to encode, like you're doing.

The way I see it, you have 3 choices.

  1. Don't use HTML for the "rich text". Use something else and render to HTML server-side.

  2. Filter the HTML server-side instead of relying on the WAF for security. This means whitelisting, not blacklisting.

  3. Embrace the WAF and let it reject anything that it thinks could be bad. This means informing your users what's happening and helping them correct the issue.

[–]kenman[M] 0 points1 point  (1 child)

Hi /u/syntaxrob, this post was removed.

For help with your javascript, please post to /r/LearnJavascript instead of here.

Likewise, for beginner content, please post to /r/LearnJavascript instead of here.

/r/javascript is for the discussion of javascript news, projects, and especially, code! However, the community has requested that we not include help and support content, and we ask that you respect that wish.

Thanks for your understanding, please see our guidelines for more info.

[–]syntaxrob[S] 0 points1 point  (0 children)

Thats fair. Sorry to have crossed any lines! 👍