Re: [pear-webmaster] rasmus's magic tool

On Wed, 2005-06-01 at 19:20 -0700, Rasmus Lerdorf wrote: > Helgi Þormar wrote: > > On Thu, 2005-06-02 at 01:27 +0200, Martin Jansen wrote: > > > >>On Mon May 09, 2005 at 08:0337AM +0000, Helgi Þormar wrote: > >> > >>>On Mon, 2005-05-09 at 01:10 -0400, Lukas Smith wrote: > >>> > >>>>[01:07] <Rasmus> This is the output from running it on the top page of > >>>>pear.php.net > >>>>[01:07] <Rasmus> get > >>>>http://pear.php.net//<test_xss>/? > >>>>[01:07] <Rasmus> Raw tags are echoed back unfiltered > >>>>[01:07] <Rasmus> <p>The requested document > >>>><i>//<test_xss> > >>>>[01:08] <Rasmus> might want to htmlentity that > >>> > >>>Thanks, I've been doing a bit cleanup, backporting Rasmus fixes to > >>>bugsweb over to pear and peclweb plus some other fixes, will look into > >>>this one also if it's not fixed already. > >> > >>What's the status on this? Will you be able to fix it in a reasonable > >>timeframe? > > > > > > I've committed a lot of fixes for this, so we are somewhat safe, I think > > I have more improvements in my local checkout, for the bug system and > > other stuff I already did, just it's been a crazy month for me, I'll try > > to find time to look into this stuff better very soon. > > This one is still not fixed: > > > http://pear.php.net/package-search.php/bogus_path/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cb There is a lot not fixed or needs better fixing :-) But thanks for that, can we get back to you for further scans when we've found time to cleanup some more ? - Helgi