Re: [pear-webmaster] rasmus's magic tool

Helgi Þormar wrote: > On Thu, 2005-06-02 at 01:27 +0200, Martin Jansen wrote: > >>On Mon May 09, 2005 at 08:0337AM +0000, Helgi Þormar wrote: >> >>>On Mon, 2005-05-09 at 01:10 -0400, Lukas Smith wrote: >>> >>>>[01:07] <Rasmus> This is the output from running it on the top page of >>>>pear.php.net >>>>[01:07] <Rasmus> get >>>>http://pear.php.net//<test_xss>/? >>>>[01:07] <Rasmus> Raw tags are echoed back unfiltered >>>>[01:07] <Rasmus> <p>The requested document >>>><i>//<test_xss> >>>>[01:08] <Rasmus> might want to htmlentity that >>> >>>Thanks, I've been doing a bit cleanup, backporting Rasmus fixes to >>>bugsweb over to pear and peclweb plus some other fixes, will look into >>>this one also if it's not fixed already. >> >>What's the status on this? Will you be able to fix it in a reasonable >>timeframe? > > > I've committed a lot of fixes for this, so we are somewhat safe, I think > I have more improvements in my local checkout, for the bug system and > other stuff I already did, just it's been a crazy month for me, I'll try > to find time to look into this stuff better very soon. This one is still not fixed: http://pear.php.net/package-search.php/bogus_path/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cb