Safe URLs in wiki
Marc-Etienne Vargenau <[email protected]> Thu, 18 Sep 2008 17:57:59 +0200
| Newsgroups | gmane.comp.web.wiki.phpwiki.talk |
|---|---|
| Organization | Alcatel-Lucent (CTO/RDEI/SRA) |
| Message-ID | <[email protected]> |
Hello,
In stdlib, there is a function that tests if a URL is "safe"
function IsSafeURL($url) {
return !preg_match('/([<>"])|(%3C)|(%3E)|(%22)/', $url);
}
In practice, our users need to include in the wiki URLs generated by Live Meeting
https://www.livemeeting.com/cc/alcatel_lucent/join?id=4QPTFJ&role=present&pw=S%3Cpk%2F2fbS
and these URLs can contain %3C
What would be the risk to allow such URLs?
Best regards,
Marc-Etienne
--
================================================================== ------
| Marc-Etienne Vargenau | / \
| Alcatel-Lucent France, Route de Villejust, 91620 NOZAY, FRANCE | / /|'` \
| +33 (0)1 30 77 28 33, [email protected] | | /'| ' |
================================================================== \ |/ /
| L'essence des Mathématiques est dans leur liberté. | \ /
| Georges Cantor | ------
==================================================================
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/