# User input validation
**URL:** https://meta.discourse.org/t/user-input-validation/172741
**Category:** Development
**Created:** [December 9, 2020, 12:16pm UTC](https://meta.discourse.org/t/user-input-validation/172741 "2020-12-09T12:16:15Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Cal](https://meta.discourse.org/u/Cal)
#### Post date: [December 9, 2020, 12:16pm UTC](https://meta.discourse.org/t/user-input-validation/172741/1 "2020-12-09T12:16:15Z")
Does anyone know if it’s possible to implement custom user input validation, specifically for new users, new admin badges and new user fields.
After a penetration test we found we are vulnerable to HTML Injection and other malicious inputs in these areas and wondered if there is a way to further validate these inputs to improve security (possibly by using regex or another way to achieve the same result)
Thanks in advance!
---
### Author:  [@neounix](https://meta.discourse.org/u/neounix)
#### Post date: [December 9, 2020, 12:40pm UTC](https://meta.discourse.org/t/user-input-validation/172741/2 "2020-12-09T12:40:42Z")
> [@Cal](#):
>
> Does anyone know if it’s possible to implement custom user input validation, specifically for new users, new admin badges and new user fields.
Yes, it is possible for you, or a professional Discourse plugin developer, to write a “relatively simple” plugin to add validation to models.
Perhaps you should post your request in #Marketplace?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 9, 2020, 12:43pm UTC](https://meta.discourse.org/t/user-input-validation/172741/3 "2020-12-09T12:43:51Z")
What fields are susceptible to html injection?
---
### Author:  [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [December 9, 2020, 1:09pm UTC](https://meta.discourse.org/t/user-input-validation/172741/4 "2020-12-09T13:09:17Z")
Exacly what I was going to ask.
---
### Author:  [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [December 9, 2020, 1:14pm UTC](https://meta.discourse.org/t/user-input-validation/172741/5 "2020-12-09T13:14:51Z")
I hope he tells the developers in private before us 🙂
Doesn’t Discourse take part in a scheme through which they will pay for security vulnerability discoveries?
---
### Author:  [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [December 9, 2020, 1:19pm UTC](https://meta.discourse.org/t/user-input-validation/172741/6 "2020-12-09T13:19:11Z")
> [@Jonathan5](#):
>
> Doesn’t Discourse take part in a scheme through which they will pay for security vulnerability discoveries?
Indeed: [hackerone](https://hackerone.com/discourse)
---
### Author:  [@Cal](https://meta.discourse.org/u/Cal)
#### Post date: [December 9, 2020, 1:58pm UTC](https://meta.discourse.org/t/user-input-validation/172741/7 "2020-12-09T13:58:15Z")
Thanks for getting back so quickly!
So the affected parameters are:
User Creation: name, title, location, bio\_raw
Badges: name, description, long\_description
user fields: name, description
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [December 9, 2020, 2:01pm UTC](https://meta.discourse.org/t/user-input-validation/172741/8 "2020-12-09T14:01:34Z")
> [@Cal](#):
>
> Thanks for getting back so quickly!
We are part of the community but not staff. You would need to a get a response from them on this. However, given the attention paid to vulnerabilities and security by the team, plus the use of industry standard frameworks, I would reserve judgement until they’ve had time to respond.
This doesn’t sound like something you should need to mitigate, but at the same time, it may already be addressed in some way.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [December 9, 2020, 3:03pm UTC](https://meta.discourse.org/t/user-input-validation/172741/9 "2020-12-09T15:03:11Z")
I would like very surprised if those allowed html injection. Please demonstrate that by editing your profile here with a trivial example.
---
### Author:  [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [December 9, 2020, 3:25pm UTC](https://meta.discourse.org/t/user-input-validation/172741/10 "2020-12-09T15:25:10Z")
Welcome to Meta @Cal 👋
> [@Cal](#):
>
> User Creation: name, title, location, bio\_raw
>
> user fields: name, description
Those fields are sanitized/escaped. Plus, Discourse has [CSP](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243) enabled by default.
> [@Cal](#):
>
> Badges: name, description, long\_description
Those are also sanitized. They’re also only accessible to admins, and there’s also CSP.
If you’ve found a user-input security issue that happens with CSP on, we’d love to hear about it [here](https://hackerone.com/discourse?type=team).
---
### Author:  [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [December 9, 2020, 4:50pm UTC](https://meta.discourse.org/t/user-input-validation/172741/11 "2020-12-09T16:50:54Z")