Re: XSS vs HTML_BBCodeParser
| From: | Christian Weiske | Date: | Mon, 02 Jan 2012 06:44:10 +0000 |
| Subject: | Re: XSS vs HTML_BBCodeParser | ||
| References: | 1 | Groups: | php.pear.qa |
| Request: | Send a blank email to pear-qa+get-5980@lists.php.net to get a copy of this message | ||
Hello Daniel,
> http://pear.php.net/bugs/bug.php?id=14579 is one I just
> stumbled
> across. I'd apply the fix described, but no doubt there will be other
> ways to subvert it.
>
> Can we take a look and come up with the best way to fix this
> collectively?
We should look how htmlpurifier does it.
--
Regards/Mit freundlichen Grüßen
Christian Weiske
-=≡ Geeking around in the name of science since 1982 ≡=-
Attachment: [application/pgp-signature] signature.asc
Attachment: [application/pgp-signature] signature.asc