Safe URLs in wiki

Marc-Etienne Vargenau <[email protected]> Thu, 18 Sep 2008 17:57:59 +0200
Newsgroups gmane.comp.web.wiki.phpwiki.talk
Organization Alcatel-Lucent (CTO/RDEI/SRA)
Message-ID <[email protected]>
Hello,

In stdlib, there is a function that tests if a URL is "safe"

function IsSafeURL($url) {
     return !preg_match('/([<>"])|(%3C)|(%3E)|(%22)/', $url);
}

In practice, our users need to include in the wiki URLs generated by Live Meeting

https://www.livemeeting.com/cc/alcatel_lucent/join?id=4QPTFJ&role=present&pw=S%3Cpk%2F2fbS

and these URLs can contain %3C

What would be the risk to allow such URLs?

Best regards,

Marc-Etienne

-- 
==================================================================    ------
| Marc-Etienne Vargenau                                          |   /      \
| Alcatel-Lucent France, Route de Villejust, 91620 NOZAY, FRANCE |  /  /|'`  \
| +33 (0)1 30 77 28 33, [email protected]  | |  /'| '   |
==================================================================  \   |/   /
| L'essence des Mathématiques est dans leur liberté.             |   \      /
|                                Georges Cantor                  |    ------
==================================================================

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/