Mosaico returns 403 error due to data-bind attribute in template html

Question

We get a 403 error by Wordfence Security on a wordpress site while creating a Mailing using Mosaico.

On little investigation - I see the error is due to the addition of data-bind attribute in the HTML. For eg. if the template html is -

<p style="color: #aaaaaa; font: 14px/18px Frutiger, 'Frutiger Linotype', 'Helvetica Neue', Helvetica, Arial, sans-serif; ; margin: 0 0 10px 0; padding: 0; text-align: center;" data-bind="virtualAttrStyle: 'color: #AAAAAA; '+'font: '+('14px/18px '+$root.content().sansFace())+'; '+'margin: 0 0 10px 0; '+'padding: 0; '+'text-align: center;'+''">
  Don't want to receive any more email from us?
  <br />
  Simply 
  <a style="color: #e0e0e0;" 
    href="https://domain_name/wp-content/plugins/files/civicrm/extensions/uk.co.vedaconsulting.mosaico/packages/mosaico/templates/tedc15/*|UNSUB|*" 
    target="_blank" 
    data-bind="virtualAttrStyle: 'color: #E0E0E0;'+''">
    unsubscribe
  </a> from our list.
</p>

The error in the console pops up not letting the template to be saved.

403 Forbidden

A potentially unsafe operation has been detected in your request to this site, and has been blocked by Wordfence.

If I remove the data-bind attribute from the anchor tag - the mailing is saved without any errors. Also, if the Wordfence plugin is disabled - the 403 error is not shown - but this might not be the solution.

Any thoughts on why this error might be arising and ways to fix it?

Answer 1

Wordfence uses knockout.js for data binding. I see Mosaico adds data-bind attribute to the HTML input which is considered prone to XSS attack by knockout and 403 error is shown by wordfence.

I've disabled XSS in the Wordfence setting and the mailing is working correctly for now. Happy to look for answer if there is a way to avoid XSS attack in mosaico template builder?

Answer 2

I also had a similar problem - I solved by whitelisting the specific url using Wordfences Live traffic view (Wordfence -> tools) to locate the blocked connection and then whitelist param from firewall.

Answer 3

I had a similar issue, but just using one of the standard sample mailing templates (not Mosaico). Disabling the XSS option in Wordfence also worked, although I'd like to keep the XSS check.