Re: Using kses HTML filter
"Paul Lesniewski" <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, May 8, 2008 at 12:10 PM, Tomas Kuliavas <[email protected]> wrote: > Thijs Kinkhorst <kink <at> squirrelmail.org> writes: > >> >> Hi all, >> >> It's well known that our current HTML filter is based on blacklisting, and >> although there haven't been recent bugs found, blacklisting is an >> inherently dangerous approach. A whitelisting filter this therefore more >> desirable. >> >> Has anyone taken a look at KSES before? It's a plug-and-play HTML filter >> on a whitelist based approach. I'm not sure how good it would work with >> SquirrelMail, but it may be interesting to try it out if noone has done >> that before. >> >> http://sourceforge.net/project/shownotes.php?release_id=302996 > > Read bugtraq information about kses. You could provide a link since you already seem to have found something. Maybe: http://www.securityfocus.com/bid/28599/info http://www.securityfocus.com/archive/1/490402 > SquirrelMail uses html_filter which can be switched to blacklist or whitelist > mode. You are using blacklist. There is also this more recent incarnation of kses: http://bioinformatics.org/phplabware/internal_utilities/htmLawed Or: http://htmlpurifier.org/ ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel