XSS vs HTML_BBCodeParser
| From: | Daniel O'Connor | Date: | Mon, 02 Jan 2012 02:19:47 +0000 |
| Subject: | XSS vs HTML_BBCodeParser | ||
| Groups: | php.pear.qa | ||
| Request: | Send a blank email to pear-qa+get-5979@lists.php.net to get a copy of this message | ||
Hi all,
http://pear.php.net/bugs/bug.php?id=14579 is
one I just stumbled across.
I'd apply the fix described, but no doubt there will be other ways to
subvert it.
Can we take a look and come up with the best way to fix this collectively?