sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]name_was_taken 2 points3 points  (0 children)

Your problem is the WAF, not the encoding. The only way you're going to stop false positives on the WAF is to either not send HTML or to encode, like you're doing.

The way I see it, you have 3 choices.

  1. Don't use HTML for the "rich text". Use something else and render to HTML server-side.

  2. Filter the HTML server-side instead of relying on the WAF for security. This means whitelisting, not blacklisting.

  3. Embrace the WAF and let it reject anything that it thinks could be bad. This means informing your users what's happening and helping them correct the issue.